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SECTION  1.0 
INTRODUCTION 


1  . 1  FOREWORD 

This  design  guide  has  been  prepared  as  an  aid  to  the  project 
manager,  beginning  with  the  conceptual  phase  through  development,  and 
as  a  guide  to  the  system  design  engineer  concerned  with  the  incorporation 
of  built-in-test  (BIT)  and  bui It-i n-test  equipment  (BITE)  into  the 
weapon  system.  It  is  not  the  intent  of  this  document  to  detail  the 
"how  to"  but  rather  to  identify  those  subject  areas  that  need  to  be 
considered  in  determining  the  requirement  for  BIT. 

During  the  development  of  a  weapon  system,  emphasis  is  usually 
placed  on  design  of  the  basic  system  to  meet  performance  requirements 
with  support  requirements  given  a  much  lower  priority  in  both  time  and 
dollars.  There  is  evidence  that  this  approach  may  well  continue  as  the 
costs  of  weapon  systems  increase  and  dollars  become  more  difficult  to 
obtai n. 


However,  if  life-cycle  cost  goals  are  to  be  met  the  support 
requirements  must  be  addressed  early  enough  to  influence  the  testability 
of  the  design.  Maintainability  considerations  such  as  performance 
monitoring,  BIT,  BITE,  on-line  versus  off-line  test,  and  accessibility 
must  be  addressed  early  in  the  initial  program  development  phase. 

The  complexity  of  today's  modern  weapon  system  dictates  that 
the  means  for  testing  be  considered  and  identified  during  the  system 
concept  definition,  that  the  use  of  BIT  be  considered  as  a  means  of 
meeting  maintenance  and  operational  goals,  and  that  the  testing  addresses 
the  total  life-cycle  costs.  Both  the  project  manager  and  the  designer  must 
make  numerous  decisions  based  on  trade  studies.  These  decisions  effect 
both  hardware  and  philosophies  of  operation.  This  guide  is  intended  as  an 
aid  in  making  those  decisions. 
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Some  of  the  information  provided  in  the  design  guide  is  the 
distillation  of  available  information  contained  in  NAVMATINST  3960.9, 
Built-In-Test  (BIT)  Design  Guide1,  and  RADC-TR-78-224,  A  Design  Guide 
for  Built-In-Test2. 

1.2  PURPOSE  OF  GUIDE 

The  fundamental  purpose  of  the  Built-In-Test  Design  Guide 

is  to: 

o  Improve  weapon  system  performance  in  terms  of  equipment 
readiness  and  availability. 

o  To  improve  equipment  testability. 

To  accomplish  this,  the  design  guide  will  be  a  source  of  reference  to 
all  levels  of  project/program  management,  designers,  and  the  varied 
engineering  disciplines.  As  a  guide  it  is  intended  to  discuss  options 
available  rather  than  a  how-to-design  handbook.  The  user  will  be 
acquainted  with  areas  to  be  considered  in  developing  the  role  BIT  will 
have  within  the  total  weapon  system.  The  overriding  purpose  of  this 
guide,  therefore,  is  to  influence  the  reader  to  ensure  the  early  con¬ 
sideration  of  the  requirement  for  BIT  to  support  the  Army  Missile 
Systems. 

1.3  DEFINITION  OF  BIT/BITE 

MIL-STD-1309,  Definitions  of  Terms  for  Test,  Measurement  and 
Diagnostic  Equipment,  defines  those  terms  normally  associated  with  test, 
measurement  and  diagnostic  equipment  (TMDE).  The  definition  of  BIT  and 
BITE  as  stated  in  the  standard  are  as  follows: 

o  Built-in-Test  (BIT) 

A  test  approach  using  BITE  or  self  test  hardware  or  soft¬ 
ware  to  test  all  or  part  of  the  unit  under  test. 
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o  Built-In-Test  Equipment  (BITE) 

Any  device  which  is  part  of  an  equipment  or  system  and 
is  used  for  the  express  purpose  of  testing  the  equip¬ 
ment  or  system.  BITE  is  an  identifiable  unit  of  the 
equipment  or  system. 

Unless  otherwise  stated,  the  definitions  contained  in  MIL-STD- 
1309  apply  to  this  guide.  Where  needed  or  appropriate,  definitions  will 
be  contained  within  this  guide  to  minimize  the  need  to  refer  to  the 
referenced  military  standard. 

1.4  APPLICATION  OF  GUIDE 

This  BIT  Design  Guide  is  intended  to  provide  guidance  to  the 
weapon  system  planner,  the  weapon  system  project  or  program  manager, 
the  system  designer,  the  detailed  equipment  designer,  the  test  engineer, 
the  software  programmer,  and  the  test  equipment  designer.  The  user  at  • 
the  weapon  system  level  would  include  planners,  estimators,  operations 
research  analyst,  and  specification  writers.  The  guide  can  be  applied 
during  the  pre-DSARC  phase  and  the  acquisition  phase  as  well  as  the 
detailed  design  phase  by  providing  guidelines  of  the  options  available. 
The  specific  use  of  the  guide  will  be  at  the  direction  of  the  program 
manager.  The  guide  is  organized  to  provide  the  more  general  information 
in  Sections  2.0  through  4.0  and  the  Army  Missile  System  details  in 
Sections  5.0  through  8.0. 

1.5  REFERENCE  DOCUMENTS 

The  following  lists  those  documents,  military  standards,  speci¬ 
fications,  etc.  that  are  applicable  to  BIT  and  BITE. 

o  MIL-STD-1309  -  Military  Standard  Definitions  of  Terms  for 
Test,  Measurement  and  Diagnostic  Equipment 
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o  MIL-STD-415  -  Military  Standard  Test  Provisions  for 
Electronic  Systems  and  Associated  Equipment,  Design 
Criteria  For 

o  AR  750-1  -  Maintenance  of  Supplies  and  Equipment 
Maintenance  Concepts 

o  AR  70-38  -  RDT&E  of  Materiel  for  Extreme  Climatic 
Conditions 

o  MIL-STD-810  -  Environmental  Test  Methods 

o  MIL-STD-1388  -  Logistic  Support  Analysis 

o  PAM  750-21  -  Logistic  Support  Modeling 

o  TM  38-710  -  Integrated  Logistic  Support  -  Implementation 
Guide  for  DOD  Systems  and  Equipments 

o  TM  38-703-3  -  Integrated  Logistic  Support  (ILS),  Maint¬ 
enance  Engineering  Analysis  Data  System  (MEADS) 

o  MIL-STD-470  -  Maintainability  Program  Requirements 
(For  Systems  and  Equipment) 

o  MIL-H-46855  -  Human  Engineering  Requirements  for  Military 
Systems,  Equipment  and  Facilities 

o  MIL-ST0-480  -  Configuration  Control  -  Engineering  Changes, 
Deviations  and  Waivers 

o  MIL-STD-721  -  Definition  of  Effectiveness  Terms  for  Relia¬ 
bility,  Maintainability,  Human  Factors  and  Safety 
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SECTION  2.0 


BIT/BITE  APPLICATION  TO 
SYSTEM  MAINTENANCE 

2.1  MAINTENANCE  LEVELS 

Within  the  Department  of  the  Army,  four  categories  of  maint¬ 
enance  are  used.  These  categories  are: 

o  Organizational  Maintenance 

o  Direct  Support  Maintenance 

o  General  Support  Maintenance 

o  Depot  Maintenance 

The  categories  are  used  to  designate  the  scope  of  maintenance  to  be 
performed  at  the  various  command  levels.  Army  regulation  AR  750-1  defines 
these  maintenance  categories  as  follows: 

a .  Organizational  Maintenance 

Organizational  maintenance  is  the  responsibility  of  the  unit 
commander  in  maintaining  the  operational  readiness  of  equip¬ 
ment  assigned  or  under  his  control.  This  category  of  maint¬ 
enance  includes  preventive  maintenance  services  and  those 
organizational  level  repairs  authorized  in  appropriate 
technical  publications.  . 

b.  Direct  Support  Maintenance 

Direct  support  maintenance  normally  is  assigned  to  and 
i performed  by  designated  TOE  or  TDA  maintenance  activities 
in  direct  support  of  using  organizations.  The  repair  of 
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end-items  or  unserviceable  assemblies  is  performed  in 
support  of  using  organizations  on  a  return-to-user  basis. 

c.  General  Support  Maintenance 

General  support  maintenance  normally  is  assigned  to  and 
performed  by  designated  TOE  or  TDA  maintenance  units  or 
activities  in  support  of  individual  Army  area  supply 
operations.  This  category  of  maintenance  constitutes 
the  principal  materiel  overhaul  means  available  to  the 
Field  Army  Commander  in  maintaining  his  materiel  assets. 
General  support  maintenance  units  and  activities  repair 
or  overhaul  materiel  in  accordance  with  maintenance 
standards  for  each  item  to  obtain  ready  for  issue  con¬ 
dition  based  upon  the  supported  Army  area  supply  require¬ 
ments.  When  required,  general  support  maintenance  units 
may  provide  support  on  a  return-to-user  basis  for  equip¬ 
ment  beyond  the  capacity  of  direct  support  units. 

d.  Depot  Maintenance 

Depot  maintenance  normally  is  assigned  to  and  performed 
by  designated  TDA  industrial-type  activities  or  commercial 
contracts.  This  category  of  maintenance  assists  in 
satisfying  total  Department  of  the  Army  materiel  require¬ 
ments  by  overhaul  or  rebuild  of  unserviceable  assets 
requiring  maintenance  beyond  the  capability  of  general 
support  maintenance  units  or  activities.  Depot  maintenance 
may  be  performed  overseas  during  wartime  as  necessary  and 
feasible  to  support  military  operations  in  general  or  for 
specific  commodities. 

Performance  of  corrective  maintenance  at  any  level  of  maintenance 
requires  test  equipment.  The  basic  division  in  test  equipment  is  either 
on-line  test  or  off-line  test  using  either  manually  operated  or  automatic 
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test  equipment.  An  effective  organizational  level  on-line  test  capa¬ 
bility  using  BIT  provides  for  an  improved  effectiveness  at  the  other 
maintenance  levels  when  the  total  system  test  requirements  consider 
all  levels  of  maintenance.  BIT  at  the  system  level  can  be  a  useful  test 
when  utilized  at  other  maintenance  levels. 

2.2  TESTABILITY  REQUIREMENTS 

Testability  has  those  characteristics  that  permit  verification 
of  system  performance  and  the  isolation  of  faulty  components  or  sub¬ 
systems  to  some  appropriate  pre-determined  level. 

With  today's  complex  weapon  systems,  the  need  to  design  for 
testability  is  recognized  as  a  basic  mandatory  requirement  to  be  levied 
on  all  new  equipment  design  in  order  to  meet  the  established  maintenance 
goals.  The  incorporation  of  testability  into  the  equipment  design  is 
basic  in  satisfying  a  maintenance  concept  that  accounts  for  the  appro¬ 
priate  support  trade-offs  and  levels  of  maintenance  actions  required  for 
a  particular  weapon  system. 

Design  for  testability  must  consider  all  levels  of  maintenance 
from  Organizational, Direct  Support,  General  Support  to  Depot  Level  and 
address  both  the  hardware  aspects  of  the  system  as  well  as  the  software. 
Testability  at  the  Organizational  Level  can  utilize  on-line  test  with 
BIT  and  performance  monitoring  systems  or  self-test  functions.  At  the 
other  maintenance  or  repair  levels,  testability  can  be  accomplished 
using  off-line  test  equipment  including  ATE  as  well  as  BITE  that 
can  function  independent  of  the  total  weapon  system.  A  combination  of 
approaches  can  be  used  to  implement  testability  at  the  different  maint¬ 
enance  levels. 

Early  development  of  testability  into  the  basic  design  and 
management  attention  to  this  is  essential  to  accomplishing  the  overall 
testability  requirement.  Of  equal  concern  is  the  need  to  establish  a 
common  system  test  design  that  is  not  only  comprehensive  but  compatible 
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with  the  ATE  selected  for  the  particular  weapon  system.  Without  a 
common  testability  approach  the  cost  and  complexity  may  be  prohibitive. 

The  design  for  testability  shall  be  included  as  an  integral 
part  of  the  system  engineering  effort.  The  requirements  or  specific¬ 
ations  for  testability  must  be  established  in  the  early  stages  of  the 
system  design.  Program  management  should  ensure  that  testability 
requirements  are  contractually  imposed  on  the  equipment  developer. 

Testability  of  prime  equipment  design  is  directly  related 
to  the  degree  of  engineering  emphasis  placed  on  the  design  from  its 
inception  and  continued  throughout  its  development.  The  initial  design 
must  contain  provisions  for  testability  and  supportability  features 
which  lend  themselves  to  improved  operational  readiness  while  implemen¬ 
ting  sound  system  engineering  design  principles.  Functional  designs 
should  provide  for  complimentary  overlapping  testability  features,  in¬ 
tegrated  with  BIT  and  ATE  compatible  design  features. 

In  designing  for  testability,  the  Failure  Mode  and  Effects 
Analysis  (FMEA)  is  a  significant  task.  The  FMEA  affords  a  check  to 
determine  that  the  system  will  not  be  adversely  affected  by  a  malfun¬ 
ction  and  will  determine  the  level  of  repair.  In  addition,  BIT  re¬ 
quirements  are  specified  and  the  failure  modes  are  defined. 

The  failure  Mode  and  Effects  Analysis  is  further  discussed 
in  Paragraph  3.11  of  Section  3.0. 

2.3  BIT/BITE  VERSUS  ATE 

The  Built-in-Test  and  Built-in-Test  Equipment  are  not  in 
competition  with  Automatic  Test  Equipment;  rather,  both  are  essential 
elements  in  the  system  concept.  Such  considerations  as  state-of-the- 
art,  weight,  cost,  test  time,  and  mission  readiness  requirements 
dictate  the  trades  that  must  be  made  by  the  design  engineer  in  deter¬ 
mining  the  use  of  BIT/BITE  and  ATE  as  well  as  manual  testing.  The 
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design  engineer  must  be  responsible  in  his  design  for  specifying  the 
requirements  for  both  BIT/BITE  and  ATE  as  part  of  a  total  weapon  system 
concept. 


During  the  initial  equipment  design,  BIT  can  be  incorporated 
with  relative  ease.  Much  of  today's  electronics  contain  a  microprocessor 
or  computer  which  further  simplifies  the  incorporation  of  readiness  test¬ 
ing  as  well  as  diagnostics  testing.  If  the  equipment  development  has 
progressed  beyond  a  certain  point,  it  may  be  necessary  to  utilize  external 
test  equipment  even  though  it  may  be  more  costly  than  having  incorporated 
BIT  during  the  initial  equipment  design. 

2.4  BIT  COMPATIBILITY  WITH  ATE 

Test  requirements  must  be  established  at  the  weapon  system 
level.  The  requirements  for  testing  must  be  analyzed  at  that  level  for 
coherent  tests  between  maintenance  levels  and  to  obtain  duplicate  test 
results.  Where  BIT  is  used  to  further  isolate  the  failure  in  order  that 
the  part  be  repaired,  the  BIT  tolerance  band  must  be  wider  than  that  for 
ATE.  To  do  otherwise,  the  failure  detected  by  BIT  will  not  be  verified 
by  the  ATE.  The  never  ending  circle  is  obvious  «  with  the  unit  returned 
to  operation  after  ATE  verifying  its  proper  operation  and  BIT  again  re¬ 
jecting  it.  Figure  1  depicts  the  widening  tolerance  band  between  levels 
of  maintenance.  Note  also  the  increase  in  the  test  equipment  tolerance 
or  accuracy  maintenance  levels. 

2.5  SYSTEM  MAINTENANCE  CONCEPT  REQUIREMENTS 

This  guide  is  not  intended  to  define  the  maintenance  require¬ 
ments  for  any  given  weapon  system  in  either  specific  or  generic  terms. 

The  formulation  of  the  weapon  system  requirements  are  first  defined  by 
life  cycle  goals.  For  a  system  being  replaced  by  a  newer  and  updated 
system  these  goals  could  be: 


TOLERANCE 


BAND  LEVELS  OF 

MAINTENANCE 


ORGANIZATIONAL 


DIRECT  SUPPORT 


GENERAL  SUPPORT 


DEPOT 


Figure  1.  Tolerance  Cone 


o  Less  equipment 


o  Less  maintenance  at  a  specific  maintenance  level 
o  Fewer  operating  personnel 

o  Fewer  replaceable  line  items 

The  maintenance  concept  is  based  on  meeting  specific  life 
cycle  goals  which  are  established  at  the  system  level.  The  concept 
defined  to  achieve  these  goals  could  be: 

o  Maximum  use  of  operating  personnel  at  organizational 
level  for  maintenance  with  minimum  skill  required. 

o  Replacement  at  major  assembly  level  utilizing  easily 
removable  plug-in  assemblies. 

o  Minimize  number  of  spares  required  at  Organizational 
Level  Maintenance. 

The  above  are  examples  of  system  goals  and  maintenance  concepts  that 
could  be  established  at  the  system  level.  In  addition,  the  use  of  BIT 
and  BITE  could  be  defined  as  a  maintenance  requirement  to  meet  specific 
system  goals.  Both  program  management  and  designers  should  consider  the 
use  of  BIT/BITE  as  a  means  of  effectively  meeting  established  life 
cycle  cost  goals  and  the  ensuing  maintenance  concept. 

In  many  cases  a  system  requirement  which  is  established  to 
meet  a  specific  life  cycle  cost  goal  may  not  be  as  realistic  in  real 
life  as  intended.  For  example,  a  maintenance  system  dictates  the  use 
of  BIT/BITE  and  its  design  is  based  on  a  specific  skill  level  being 
available  and  utilized  for  the  maintenance  actions  specified.  Faced 
with  a  volunteer  Army,  and  possibly  supplemented  with  draftees  during 
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a  crisis,  it  is  certainly  possible  that  the  skill  level  required  is 
either  not  available  or  exists  at  the  low  end  of  the  scale  in  capa¬ 
bility.  It  behoves  the  designer,  when  incorporating  BIT/BITE  into 
the  system  design,  to  consider  worst  possible  case  and  design  accord 
ingly. 


Weapon  sophistication  remains  our  edge  over  the  enemy,  and 
the  electronics  in  today's  weapon  system  leads  in  both  state-of-the- 
art  and  sophistication.  The  availability  of  skills  needed  to  maintain 
not  only  today's  weapon  systems  but  those  of  tomorrow  will  continue  to 
be  a  major  problem.  Weapon  system  designers  may  not  be  able  to  design 
less  sophisticated  circuits  but  the  design  of  BIT  into  these  circuits 
must  address,  in-depth,  the  skill  problem  facing  today's  Army. 

2.6  BIT  AS  A  DESIGN  REQUIREMENT 

Ideally,  the  requirement  for  incorporating  BIT  into  the  basic 
design  should  be  a  contract  requirement  imposed  at  the  program  level. 

Even  more  basic  would  be  that  the  total  weapon  system  concept  recognize 
the  requirement  for  3IT.  This  is  not  to  imply  that  unless  there  is  a 
basic  program  requirement  or  contractual  authority  specifically  for  BIT 
that  it  cannot  be  incorporated  into  the  design.  To  satisfy  other  system 
requirements  may  well  dictate  the  use  of  BlJ^riThe  implementation  of  BIT 
into  the  basic  equipment  design  could  be  don&^to  meet  availability  require¬ 
ments,  maintainability  goals,  mean-time  to  repair  goals,  test  requirements, 
etc. 


When  BIT  is  specified  as  a  system  requirement,  it  is  important 
that  it's  incorporation  be  an  inherent  design  of  the  basic  electronic 
unit.  The  early  introduction  of  the  test  and  maintenance  requirements 
into  the  initial  functional  design  will  result  in  an  effective  BIT  design. 
This  will  require  that  the  design  engineers  be  equally  qualified  in  the 
design  for  testability  as  they  are  in  the  system  design.  Since  this  is 
not  always  possible  or  practical,  it  is  necessary  that  the  design  engineers 
in  their  respective  disciplines  maintain  a  closely  coordinated  effort  to 
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achieve  the  desired  results. 


Incorporating  BIT  into  the  basic  equipment  design  can  be  an 
effective  means  of  increasing  weapon  system  availability  and  readiness 
while  reducing  the  level  and  complexity  of  maintenance.  Other  advantages 
include  a  reduction  in  supporting  test  equipment  including  ATE,  reduced 
maintenance  and  other  logistics  support  costs,  and  improved  fault 
isolation  capabilities. 

Although  BIT  designed  into  the  basic  system  will  increase  the 
front-end  design  costs,  the  trade-off  in  availability  and  reduced  maint¬ 
enance  costs  will  more  than  offset  any  disadvantages.  The  total  life 
cycle  cost  of  the  system  that  incorporates  a  well  engineered  BIT  design 
will  be  considerably  improved  over  the  system  without  BIT. 
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SECTION  3.0 

BIT  REQUIREMENT  ANALYSIS 


3.1  THE  SYSTEM  ENGINEERING  PROCESS 

The  system  engineering  process  is  defined  as  "a  logical  sequence 
of  activities  and  decisions  which  transforms  an  operational  need  into  a 
description  of  system  performance  parameters  and  preferred  system  configur¬ 
ation.  One  of  the  tools  used  as  part  of  the  system  engineering  process  is 
design-to-cost  (DTC)/1 ife-cycle  cost  (LCC)  trade-off  analysis.  This 
analysis  assists  in  optimizing  system  configuration  and  making  those  trade¬ 
offs  between  system  performance  parameters  and  cost  in  a  way  which  minimizes 
the  operational  impact  of  these  decisions.  This  process  optimizes  system 
configuration  from  the  maintenance  point  of  view  by  establishing  the  most 
favorable  modularity  for  the  specific  maintenance  concept  being  evaluated. 

The  definition  of  replaceable  and  repairable  units  is  part  of  this  general 
process  which  affects  both  design-for-testabil ity  and  built-in-test  (BIT) 
design  goals.  Thus,  both  on-line  and  off-line  automatic  testing  require¬ 
ments  become  part  of  the  trade-offs  associated  with  developing  the  system 
configuration.  Specific  automatic  testing  applications  are  evaluated  as 
elements  of  the  alternative  configurations  and  maintenance  concepts  used 
in  the  optimization  process."3 

Beginning  with  the  basic  system  concept  defined  through  operations 
research  and  technical  feasibility  studies  and  the  initial  system  require¬ 
ments  having  been  set  forth,  the  operational  and  functional  requirements 
are  defined  and  translated  into  progressively  more  detailed  operation  and 
support  functional  sequences.  Ultimately  through  iteration,  a  detailed 
set  of  performance  requirements  will  be  compiled  and  used  as  a  common  base 
in  specifying  design  requi rements ,  performance  specifications,  test  require¬ 
ments,  logistic  support,  etc.  If  the  system  is  to  be  contracted  to  industry, 
the  requirements  analysis  would  be  conducted  to  that  level  necessary  for 
preparation  of  those  specifications  required  for  contract  definition. 
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As  the  program  develops,  complete  analysis  would  be  required 
including  the  Logistics  Support  Analysis  (LSA)  which  encompasses  all 
aspects  of  the  system  end-item  design  including  performance  requirements 
for  the  end-items  and  their  components.  Within  the  system  engineering 
process  the  analyses,  including  LSA,  is  conducted  on  an  iterative  basis 
throughout  the  acquisition  cycle.  The  program  size,  complexity,  and 
schedule  will  determine  the  number  of  iterations  and  the  depth  required.- 

The  BIT  requirements  analysis  is  a  portion  of  a  total  systems 
approach  that  includes  a  test  requirements  analysis  supported  by  an  over¬ 
all  system  level  requirements  analysis  and  the  logistics  support  analysis. 
There  is  no  formalized  methodology  for  conducting  a  BIT  Requirements 
Analysis  such  as  there  is  for  the  Logistic  Support  Analysis  (LSA)  as  de¬ 
fined  in  MIL-STD-1388.  However,  there  is  a  need  for  this  analysis  for  the 
purpose  of  verifying  that  the  requirements  for  fault  detection  and  fault 
localization  are  satisfied.  Items  that  must  be  looked  at  during  analysis 
for  determining  the  requirements  for  BIT  are  identified  in  this  section. 
Much  of  the  information  needed  is  developed  from  the  LSA  and  other  formal¬ 
ized  analysis. 

3.2  SYSTEM  OPERATION 

The  system  designer  must  be  responsible  for  the  integrated  design 
of  all  elements  of  a  system  if  it  is  to  meet  the  system  operational  require 
ments.  Overemphasis  or  underemphasis  on  a  particular  aspect  of  a  system 
can  result  in  not  meeting  the  systems  requirements  for  both  its  operation 
and  its  supportability.  From  a  system  standpoint,  the  design  of  any 
element  is  interdependent  with  the  design  of  any  other  element  in  the 
system.  The  design  of  any  system,  subsystem,  or  end-item  should  not  pro¬ 
ceed  without  consideration  of  the  design  of  the  other  systems,  subsystems, 
and  end-items.  While  specific  operational  requirements  may  vary  between 
systems,  it  is  necessary  that  all  systems  be  integrated  if  a  coherent 
design  is  to  be  realized. 
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As  with  an  integrated  system  design  to  meet  specific  operational 
requirements,  the  BIT  requirements  must  be  established  at  a  system  level 
and  be  integrated  with  all  aspects  of  the  system  design,  operation,  and 
support  requirements.  BIT  can  not  be  an  afterthought  during  the  prime 
equipment  design  but  must  be  an  integral  part  of  the  system  design  and 
operation.  Overall  test  conditions  must  reflect  the  true  system  operating 
conditions  if  BIT  is  to  effectively  monitor  the  readiness  status  of  the 
weapon  system. 

3.3  MAINTENANCE  CONCEPT 

The  maintenance  concept  provides  authority  and  guidance  to  the 
maintenance  planner.  The  concept  establishes  the  levels  of  maintenance, 
types  of  maintenance,  and  maintenance  constraints.  The  concept  covers 
possible  failures  that  may  occur  at  any  point  during  the  s  .f.eduled  activi¬ 
ties  covered  by  the  operations  concept.  The  maintenance  concept  embraces 
the  non-success  path  and  is  primarily  concerned  with  the  treatment  of 
unscheduled  events  or  failures  so  that  the  system  can  be  returned  to  the 
success  path.  Scheduled  maintenance  such  as  lubrication,  coolant  replace¬ 
ment,  and  time  sensitive  parts  replacement  are  also  covered  by  the  maint¬ 
enance  concept. 

The  preliminary  maintenance  concept  provides  a  functional 
description  of  the  tasks  required  and  designates  the  maintenance  level 
at  which  each  task  will  be  performed.  The  concept  is  hardware  oriented 
and  thus  portions  are  keyed  to  the  functional  elements  defined  in  the 
system  functional  analysis.  The  concept  is  the  result  of  trade-off 
studies  and  as  such  is  an  integral  part  of  the  system  concept  optimization. 
It  is  really  the  cornerstone  of  the  structure  against  which  all  cost 
elements  are  determined  and  establishes  the  level  at  which  line  replaceable 
units  (LRU’s)  will  be  repaired.  The  preliminary  maintenance  concept  is 
the  key  element  of  life  cycle  costing  and  determines  the  best  way  to 
maintain  the  prime  weapon  system. 
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The  maintenance  concept  is  flexible  in  that  it  allows  for 
multiple  concept  levels  for  different  systems,  e.g.,  missile,  fire 
control,  launcher,  etc.  During  development  of  a  maintenance  concept, 
a  trade-off  analysis  is  a  vital  part  if  optimum  benefits  are  to  be 
realized.  As  the  program  develops,  these  trade-offs  are  progressively 
refined.  The  maintenance  concept  becomes  a  major  driving  factor  in 
determining  the  maintainability  considerations  such  as  performance 
monitoring  using  BIT/BITE,  on-line  versus  off-line  test  equipment, 
component  interchangeability,  modularization,  accessibility,  criti¬ 
cality,  standardization,  and  human  engineering  factors. 

Including  the  requirement  for  BIT  in  the  initial  development 
of  a  maintenance  concept  is  the  most  cost  effective  method  of  incorpor¬ 
ating  BIT  into  the  basic  design.  The  need  to  implement  BIT  into  the 
weapon  system  as  a  means  of  achieving  life  cycle  cost  goals  may  not  be 
apparent  if  the  logistic  support  analysis,  as  specified  in  MI L -STD -1 338-1 , 
is  not  performed.  This  guide  has  been  prepared  with  the  assumption  that 
this  analysis,  which  is  required  for  all  major  acquisitions,  will  be 
performed.  Failure  to  apply  this  standard  and  other  specified  standards 
will  affect  the  usefulness  of  this  guide. 

3.4  REPLACEABLE  UNITS 

BIT  can  be  designed  to  test  a  system  to  any  functional  level 
required  as  determined  through  the  system  analysis  and  reflected  by  the 
maintenance  concept.  The  level  of  testing  required  will  vary  between 
systems.  As  an  example,  the  level  of  testing  for  an  inertial  guidance 
system,  packaged  as  one  major  assembly,  could  be  tested  at  the  overall 
system  level  with  the  replaceable  unit  (RU)  being  the  complete  assembly. 

In  a  communications  system,  the  RU  could  be  a  plug-in  card  assembly.  BIT 
can  be  designed  to  detect  and  isolate  faults  down  to  the  chip  level,  if 
required,  depending  on  the  maintenance  concept.  At  the  organizational 
maintenance  level  the  fault  isolated  by  BIT  should  be  to  one  easily  replace¬ 
able  module  whether  it  be  a  system,  subsystem,  assembly,  or  card.  During 
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development  of  the  maintenance  concept  the  level  of  repair,  storage  of 
replacement  units,  and  skill  level  required  will  be  considered  in 
determining  the  replaceable  units. 

While  defining  the  BIT  requirements  for  the  RU ,  it  is  important 
that  other  testing  requirements  be  considered.  Compatibility  with  both 
automatic  and  manual  test  equipment  should  be  a  mandatory  requirement  for 
all  electronic  and  electrical  equipment  design.  Functional  and  diagnostic 
test  points  should  be  provided  to  allow  testing  at  the  RU's  connector. 

When  test  requirements  need  additional  circuit  data  for  fault  isolation, 
and  test  points  through  the  connector  are  not  available,  circuit  probe 
points  should  be  provided. 

3.5  TEST  REQUIREMENTS 

The  test  requirements  document  (TRD)  (Ref  MI L-STD- 1519)  is  the 
foundation  for  the  identification  of  the  test  program,  procedures,  and 
equipment.  The  TRD  is  the  result  of  the  test  requirements  analysis,  which 
is  part  of  the  logistic  support  analysis,  and  should  be  accomplished  early 
in  the  program  to  avoid  the  time  and  cost  penalties  incurred  by  delaying 
until  the  equipment  is  designed. 

The  key  to  successful  testing  is  the  development  of  a  formal 
analysis  resulting  in  consistent  test  procedures  and  requirements  within 
well  defined  boundaries.  Through  the  incorporation  of  BIT,  to  satisfy 
test  requirements  together  with  requirements  for  both  automatic  and  manual 
testing  that  are  compatible  with  BIT,  the  equipment  reliability  and  avail¬ 
ability  are  improved.  In  addition,  more  accurate  and  faster  fault  isolation 
can  be  accomplished  thereby  ensuring  that  the  necessary  performance  test 
requirements  are  met.  In  view  of  the  benefits  that  can  result  from  both 
BIT  and  ATE,  it  is  even  more  important  that  accurate  and  well -organized 
test  requirements  be  provided.  As  with  any  analysis,  the  output  is  a 
reflection  of  the  quality  of  the  input  data.  The  effort  expended  on 
obtaining  and/or  developing  quality  input  data  will  be  well  worth  it  in 
terms  of  an  improved  output. 
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3.6  FAULT  ISOLATION 

The  level  of  BIT  required  to  locate  the  malfunction  is  directly 
related  to  the  mean-time-to-repair  (MTTR)  requirement  for  the  system.  The 
total  repair  time  at  the  organizational  maintenance  level  is  the  sum  of  the 
following  basic  steps: 

o  Location 

o  Isolation 

o  Removal 
o  Replacement 
o  Checkout 

The  above  five  steps  assume  that  the  LRU  (line  replaceable  unit)  is  the 
major  assembly  level.  If  plug-in  units  within  an  assembly  are  the  RU  then 
two  additional  steps  of  disassembly  and  assembly  are  required.  These  seven 
steps  are: 

o  Location 

o  Isolation 
o  Disassembly 
o  Removal 
o  Replacement 
o  Reassembly 
o  Checkout 
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The  use  of  BIT  at  the  organizational  maintenance  level  can  virtually 
eliminate  the  location  time  and  the  isolation  time.  The  design  of  BIT 
into  the  weapon  system  design  should  be  such  that  the  fault  can  be 
isolated  to  one  specific  major  assembly  that  is  easily  removed  and 
replaced.  If  further  isolation  of  the  fault  is  required  through  the 
use  of  additional  test  equipment,  either  automatic  or  manual,  then  that 
maintenance  should  be  limited  to  general  support  or  depot  level  mainten¬ 
ance.  System  readiness  and  availability  are  of  prime  importance.  It  is 
necessary  therefore  that  in  maintaining  operational  readiness,  the  BIT 
be  designed  to  fault  isolate  to  one  major  component  and  that  removal  and 
replacement  of  that  one  component  can  be  accomplished  within  a  minimum  of 
time. 


With  the  use  of  BIT  the  checkout  time,  the  last  step  in 
returning  a  system  to  a  readiness  state,  can  be  significantly  reduced 
especially  when  the  fault  was  initially  detected  by  BIT.  The  checkout 
step  could  include  alignment,  calibration  or  other  adjustments.  At  the 
organizational  level,  these  activities  should  be  avoided  whenever  possible. 
Mot  only  could  these  tasks  require  a  higher  skill  level  than  needed  for 
the  system  operation  but  the  time  required  could  exceed  that  allocated  for 
returning  the  system  to  a  readiness  condition.  It  is  important  to  remind 
ourselves  that  the  most  sophisticated  weapon  system  is  useless  if  it  is 
not  on-line.  When  faults  do  occur,  the  time  required  to  correct  should  be 
the  very  minimum  within  cost  considerations. 

3.7  EXTERNAL  TEST  EQUIPMENT  INTERFACE 

The  design  of  the  basic  system  must  consider  the  interface 
requirements  for  external  test  equipment,  be  it  ATE  or  manual.  Depending 
upon  the  size  and  complexity  of  the  program,  interface  control  drawings 
and  documentation  may  be  necessary.  The  interface  control  drawing  would 
depict  the  interrelationship  of  the  end-item  physical  and  functional 
design  characteristics. 
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In  addition  to  the  interface  requirements  between  the  prime 
equipment  and  external  test  equipment,  the  interface  between  the  BIT 
design  and  external  testing  must  be  considered.  The  information  avail¬ 
able  from  BIT  could  be  data  that  is  required  to  be  used  for  external 
testing,  either  automatic  or  manual. 

From  past  experience,  interface  problems  can  be  both  costly 
and  time  consuming  during  development  and  testing.  Problems  can  be 
minimized  through  early  definition  of  the  external  ATE  and  the  specific 
interfaces  with  BIT.  The  extensive  use  of  computers  and  microprocessors 
in  today's  weapon  systems  can  reduce  the  interface  problem  between  BIT 
and  ATE  to  a  software  programming  problem  providing  the  information 
available  from  BIT  and  any  additional  information  required  by  ATE  is 
available  at  the  connector  interface. 

3.8  BIT  PERFORMANCE  REQUIREMENTS 

The  process  which  leads  to  the  definition  of  system  performance 
requirements  starts  with  the  translation  of  system  mission  requirements 
into  basic  functional  sequences  of  operations  to  describe  how  the  mission 
will  be  accomplished.  The  determination  of  total  system  requirements 
begins  with  identifying  and  analyzing  the  functions  required  to  operate, 
control,  maintain,  support,  produce,  assemble,  integrate,  test,  and  deploy 
the  prime  mission  equipment  as  a  basis  for  determining  the  performance 
and  design  requirements  for  supporting  equipment,  facilities,  procedures, 
skills,  and  logistics  support.  The  analysis  being  an  interative  process 
will  progress  through  more  detailed  requirements  until  complete  performance 
requirements  are  identified. 

How  each  system  level  function  is  to  be  accomplished  must  be 
broken  down  into  both  qualitative  and  quantitative  performance  requirements 
to  be  levied  upon  each  system  element.  System  or  subsystem  performance 
standards  are  the  basis  for  verifying,  during  the  system  test  and  evaluation 
program,  that  the  system  design  meets  the  stated  performance  requirements. 
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Based  on  the  maintenance  concept  and  through  analysis,  quanti¬ 
tative  requirements  are  defined  for  BIT  (and/or  BITE).  The  following 
are  examples  of  typical  BIT  performance  requ i remen ts ,  some  of  which  are 
taken  from  existing  Army  Missile  Systems: 

o  Fault  Detection 

Not  less  than  98  percent  detected  by  the  operator  using  BIT. 

or 

Given  a  faulty  system,  the  probability  of  a  "failed" 
indication  shall  be  not  less  than: 

90  percent  for  missile  with  "X"  seekers 
80  percent  for  missile  with  "Y"  seekers 
95  percent  for  missile  less  seeker 
90  percent  for  launcher  electronics 
95  percent  for  "Z"  system  electronics 

and/or 

Given  a  faulty  system,  the  probability  of  a  "good" 
indication  shall  be  not  more  than: 

10  percent  r  -  missile  with  "X"  seekers 
20  percent  for  missile  with  "Y"  seekers 
5  percent  for  missile  less  seeker 
10  percent  for  launcher  electronics 
5  percent  for  "Z"  system  electronics 

or 
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Given  a  good  system,  the  probability  of  a  "good" 
indication  shall  be  not  less  than  98  percent. 

or 

Given  a  good  system,  the  probability  of  a  "failed" 
indication  shall  be  not  more  than  2  percent. 

or 

BIT  shall  detect  failures  (and  out  of  tolerance)  which 
represent  at  least  90  percent  of  the  system  (or  sub¬ 
system)  probable  failures. 

o  Fault  Localization 

Not  less  than  98  percent  localized  by  operator  using  BIT. 
o  Availability 

The  BIT  design  shall  have  an  operational  availability  of 
not  less  than  95  percent  when  operating  in  the  system 
envi ronment. 


or 

The  maintenance  man-hours  for  both  preventive  and  corrective 
per  equipment  operating  hour  ratio  of  0.002  or  less. 

o  Repai r  Time 

The  time  to  repair  a  system  with  BIT  at  the  Organizational 
level  is  another  way  to  state  the  BIT  availability. 
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o  MTBF 

The  MTBF  of  the  BIT  design  shall  be  at  least  a  factor 
of  two  in  improvement  over  the  prime  equipment  design. 

or 

The  MTBF  of  the  BIT  shall  be  not  less  than  500 
operating  hours. 

o  Rel  i  abi  1  i  ty 

Reliability  in  an  expression  of  MTBF  of  the  system, 
o  False  Alarm  Rate 

The  false  alarm  rate  of  BIT  shall  not  exceed  3  percent 
of  the  fault  detected. 

o  Maintainability 

The  MTTR  will  be  "X"  minutes  from  fault  detection. 

The  above  quantitative  BIT  performance  requirements  are 
intended  as  examples  only.  Each  Army  Missile  System  Program  must 
develop  their  specific  performance  requirements  tailored  to  that  system. 


3.9  COST  CRITERIA 

Life  Cycle  Cost  (LCC)  analysis  is  a  basic  tool  used  in  the 
evaluation  of  logistics  resource  requirements  and  is  used  in  conjunction 
with  such  items  as  system  effectiveness  and  technical  performance  in 
determining  cost  effectiveness.  The  LCC  serves  to  define  areas  of  high 
support  costs  as  a  result  of  design  decisions,  defines  the  impact  of 
operational  requirements  or  support  policy  alternatives,  and  provides 
a  means  for  evaluating  built-in  test  versus  external  support  equipment 
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be  it  ATE  or  manually  operated  test  equipment.  Whenever  possible,  cost 
factors  should  be  based  upon  pertinent  data  provided  by  the  procuring 
activity  from  surveillance  of  operational  systems. 

It  is  essential  that  the  method  of  supporting  the  weapon 
system  be  carefully  considered  because  of  the  significant  effect  of 
support  on  the  total  program  life-cycle  cost.  It  is  important  that 
both  BIT  and  external  test  equipment  be  looked  at  in  order  that  the 
optimum  approach  or  mix  be  identified  and  the  cost  trade-offs  be  performed. 

In  performing  trade-offs  of  candidate  designs  to  determine  the 
extent  of  BIT  and/or  external  test  equipment  to  be  used,  the  appropriate 
trade-off  elements  must  be  defined  and  weighed,  and  the  performance  and/or 
cost  parameters  they  effect  have  to  be  calculated.  As  a  genera'  rule,  the 
incorporation  of  BIT  into  the  system  as  part  of  the  basic  prime  system 
design  will  improve  system  availability  and  reduce  the  total  life-cycle 
cost. 

3.10  SKILL  LEVELS  AMD  MANNING  REQUIREMENTS 

The  Logistic  Support  Analysis  (LSA)  identifies  the  personnel  , 
training,  and  skills  required  for  support  of  the  weapon  system  and  support 
equipment.  Coordination  should  be  maintained  with  the  design  activity 
so  the  effect  of  design  changes  can  be  reflected  in  the  training  plan. 

The  analysis  provides  identification  of  the  requirements  for  trained 
operators  and  support  personnel  for  all  levels  of  maintenance.  Personnel 
and  training  data  resulting  from  the  LSA  include  number  of  personnel 
required,  the  skill  levels,  skill  specialties  training  requirements,  and 
training  material  required. 

The  incorporation  of  BIT  into  the  basic  design  for  providing  a 
system  readiness  check  and  for  fault  location  and  isolation  should  result 
in  a  lower  personnel  skill  level  required  at  the  Organizational  maintenance 
level.  The  design  of  BIT  into  the  basic  equipment  should  address  the  skill 
levels  and  manning  requirements  to  minimize  both  of  those  requirements. 


29 


3.11 


FAILURE  MODE  AND  EFFECTS  ANALYSIS 


An  analysis  of  significant  importance  in  optimizing  a  design 
for  testability  is  the  Failure  Mode  and  Effects  Analysis  (FMEA1.  The 
FMEA  assures  that  malfunctions  will  not  adversely  affect  the  system. 

It  provides  a  check  to  determine  the  level  of  repair  and  the  BIT  require¬ 
ments  for  that  system.  In  addition,  the  specific  functional  failure  modes 
and  their  effects  are  defined.  The  FMEA  is  a  continuing  effort,  affecting 
system  and  equipment  design  and  the  logistics  support  system. 

The  first  requirement  in  the  performance  of  an  FMEA  is  to  establish 
the  basic  performance,  safety,  maintenance,  and  inspection  criteria  and  to 
identify  the  elements  of  the  functions  of  a  system,  subsystem,  or  component 
to  the  appropriate  level  in  relation  with  the  established  criteria.  This 
is  accomplished  through  the  establishment  of  detailed  equipment  and  funct¬ 
ional  block  diagrams  of  the  system  and  its  operation. 

For  each  of  the  identifiable  element  or  functions,  the  failure 
modes  and  their  effects  will  be  determined.  The  effects  will  be  considered 
in  three  categories  as  follows: 

o  The  effect  of  the  failure  by  itself  without  consideration  of 
other  realted  components  or  functions. 

o  The  effects  of  a  failure  in  combination  with  other  elements 
of  the  system  or  other  functions  so  as  to  determine  if  there 
is  a  compounding  or  accumulation  of  results. 

o  The  effect  of  the  failure  on  the  total  system  or  subsystem 
operation. 

It  is  this  identification  of  the  failure  effects  in  an  orderly 
and  logical  manner  that  provides  the  ability  to  evaluate  the  systems 
operation  in  terms  of  testability,  preventive  maintenance,  periodic  in¬ 
spection,  BIT  requirement,  and  reliability. 


The  initial  failure  analysis  is  performed  on  a  preliminary  design 
and  examines  functional  failures  at  the  subsystem  level.  The  critical 
elements  identified  are  assigned  priority  for  further  examination  to 
identify  assemblies  and  subassemblies  that  may  fail  with  mission  critical 
effects.  These  items  are  investigated  in  detail  as  to  failure  modes  and 
failure  rates  of  components  and  parts.  Prompt  attention  is  thus  directed 
to  design  improvements  in  the  sensitive  and  most  responsive  areas.  These 
critical  areas  also  become  candidates  for  incorporation  of  BIT. 

In  general,  the  following  tasks  and  requirements  are  directly 
related  to  or  dependent  upon  the  results  of  the  FMEA. 

o  BIT  requirements 

o  Test  plans  and  procedures 

o  Design  reviews 

o  Math  model  reliability  prediction  and  allocation 
o  Reliability  demonstration  tests 
o  Preventive  maintenance  and  maintainability 
o  Logistic  Support  Analysis 
o  Hazard  and  safety  analysis 

The  FMEA  is  a  valuable  tool  for  assessing  the  need  and  the 
adequacy  of  BIT.  The  initial  FMEA  based  on  the  preliminary  design  will 
provide  the  optimum  tool  for  the  identification  of  BIT  requirements.  It 
is  recognized  that  program  management  may  delay  and/or  eliminate  the 
requirement  for  FMEA  due  to  cost  constraints.  It  should  be  recognized, 


however,  that  the  longer  this  analysis  is  delayed  the  more  difficult  it 
becomes  to  influence  the  basic  design  up  to  a  point  where  it  is  no  longer 
cost  effective  to  do  so.  It  may  be  expedient  to  delay  or  even  eliminate 
the  FMEA  requirement,  but  to  do  so  is  to  ignore  the  total  life-cycle  goals. 

It  should  be  noted  again  that  failure  to  apply  the  analysis  tools 
discussed  in  this  section  will  affect  the  usefulne  s  of  this  design  guide. 
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SECTION  4.0 

BIT  DESIGN  REQUIREMENTS  -  GENERAL 


4.1  BIT  DESIGN  CHECK  LIST 

Self-test  provisions  shall  be  an  inherent  design  of  the  weapon 
system  electronic  equipment  and  provide  for  performance  evaluation  and 
fault  isolation.  The  use  of  such  BIT  designs  shall  not  jeopardize  the 
operation  or  performance  of  the  specific  electronic  equipment. 

The  intention  of  this  provision  is  as  stated  in  MIL-STD-415: 

"BIT  provisions  shall  be  added  to  an  item  for  the 
sole  purpose  of  testing  the  item.  They  shall  be 
simple  in  design  and  operation,  accurate,  easily 
maintained,  preferably  more  reliable  than  the  circuit 
providing  performance,  and  shall  not  degrade  the 
performance  of  the  item  in  which  they  are  incorporated. 

BIT  provision  shall  provide  optimum  convenience  of 
use  and  operation.  The  design  of  controls  and 
readout  devices  shall  be  such  that  they  can  be 
easily  used  and  interpreted  by  low  skill  personnel." 

The  designer  incorporating  BIT  into  the  basic  equipment  design  needs  to 
consider  some  basic  BIT  requirements,  many  of  which  are  needed  as  inputs 
to  the  system  and  logistic  requirements  analysis.  As  a  guide  to  the  BIT 
designer,  the  following  checklist  is  provided1. 

a.  The  number  of  test  points  which  should  be  monitored  on 
a  semi  continuous  basis 

b.  The  number  of  test  points  which  should  be  monitored 
daily,  weekly,  and  monthly 
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c.  The  number  of  test  points  which  should  be  monitored 
on  a  demand-basis  only 

d.  The  number  of  test  points  which  are  required  to  isolate 
failures  or  indicate  trends  at  the  black-box,  module  or 
subassembly,  printed-circuit  board,  part,  or  circuit 
levels 

e.  The  number  of  test  points  which  can  be  converted  to  dc 
voltage  (0  to  +10  Vdc)  using  resistive  dividers  only  and 
the  degree  of  accuracy  required 

f.  The  number  of  test  points  which  can  be  converted  to  dc 
voltage  (0  to  +10  Vdc)  using  active  resistance  networks 
and  the  degree  of  accuracy  required 

g.  The  number  of  test  points  requiring  ac-to-dc  conversion 
and  the  degree  of  accuracy  required 

h.  The  number  of  test  points  requiring  AF-to-dc  conversion 
and  the  degree  of  accuracy  required 

i.  The  number  of  test  points  requiring  RF-to-dc  conversion, 
the  frequencies,  and  the  degree  of  accuracy  required 

j.  The  number  of  test  points  requiring  RF  power- to-dc  voltage 
conversion,  the  ranges,  frequencies,  and  the  degree  of 
accuracy  required 

k.  The  number  of  test  points  requiring  VSWR-to-dc  voltage 
conversion,  the  maximum  VSWR  expected  at  what  frequencies, 
and  the  degree  of  accuracy  required 
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l.  The  number  and  types  of  other  monitor  converters  which 
are  required 

m.  The  number  of  test  points  which  require  some  kind  of 
stimulus  generators 

n.  The  number  of  test  points  which  can  be  contact  closures 
to  ground,  the  required  current  capacities,  and  the 
voltages  to  be  switched 

o.  The  number  of  test  points  which  can  be  contact  closures 
to  available  power,  the  required  power,  current  capacity, 
and  voltages 

p.  The  number  of  test  points  requiring  signal  generators, 
the  frequencies,  the  amplitudes,  the  degree  of  wave 
purity,  impedances,  and  the  degree  of  accuracy  required 

q.  The  number  of  test  points  requiring  pulse  generators, 

the  amplitudes,  load  impedances,  pulse  widths,  rise  times, 
fall  times,  tolerable  droop,  polarities,  and  pulse  trains 

r.  The  number  of  test  points  requiring  special  stimulus 
generators  and  their  types 

s.  The  cost  of  each  converter  listed  in  items  e.  through  1. 

t.  The  cost  of  each  stimulus  generator  in  items  m.  through  r. 

u.  The  MTBF  of  the  system  as  designed 

v.  The  MTTR  without  BIT 

w.  The  mean-down-time  (MDT)  without  BIT 
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x.  The  MTTR  with  BIT 


y.  The  MDT  with  BIT 

z.  The  MTBF  for  BIT 

aa.  The  overall  system  MTBF  with  BIT 

bb.  The  MTTR  BIT  shall  be  low,  i.e.,  10  minutes  maximum 

cc.  The  amount  of  spare  memory  available  for  software  testing 

dd.  The  amount  and  kind  of  interconnecting  hardware  required 

ee.  The  coupling  and  isolation  problems  which  are  anticipated 
for  each  test  point 

ff.  The  kind  and  level  of  noise  which  can  be  tolerated  at  each 
test  point 

gg.  The  contribution  to  total  power  consumption  due  to  BIT 

hh.  The  impact  on  equipment  modularity  as  a  result  of  additional 
hardware  functions  provided  for  BIT 

ii.  The  impact  of  additional  BIT  circuitry  on  equipment  temp¬ 
erature  profiles,  cooling  requirements,  and  other  environ¬ 
mental  factors 

jj .  The  opportunity  to  substitute  microprocessor  system 

elements  for  hardwired  BIT  control  and  monitoring  functions 


■  Some  of  these  items  are  taken  from  the  BIT  Design  Guide  prepared  for  the 
Chief  of  Naval  Material,  NAVMATINST  3960.9. 
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kk.  Passive  BIT  circuits  monitor  key  points  of  a  system  without 
the  need  for  signal  injection.  The  greater  percentage  may 
monitor  dc  voltages  or  ac  signals  that  are  to  be  present. 

The  system  need  not  be  interrupted  for  BIT  evaluation 
purposes. 

Active  BIT  systems  inject  a  signal  at  a  given  point  (such 
as  the  input  of  a  radar  receiver),  and  measure  the  response 
at  an  output  port.  In  most  applications  the  system  would 
not  be  in  an  operational  mode  during  these  tests. 

Whichever  approach  is  used  depends  upon  the  scenarios  of 
possible  applications  and  whether  such  interruptions  can  be 
tolerated.  The  choice  of  methods  must  be  determined  from 
these  aspects  at  an  early  time  of  the  system  design  phase: 
Should  I  interrupt,  or  is  it  better  to  use  passive  methods? 

11.  When  designing  BIT  circuitry,  bi-stable  multivibrators  or 

flip-flops  are  often  used.  During  a  power-up  phase  the  logic 
states  of  these  elements  are  random,  unless  special  precautions 
are  taken.  Temporarily  false  data  "bits"  may  trigger  a  mal¬ 
function  alert  during  this  period.  A  reset  function  must  be 
initiated.  This  can  be  avoided  by  either  time-delay  or  built- 
in  reset  circuits. 

It  is  also  important  to  avoid  the  automatic  premature  shutdown 
of  a  circuit  because  a  vital,  related  section  was  not  yet 
operational  at  a  given  instant  during  turn-on.  Force-fail 
circuits  are  often  activated  by  a  BIT  failure  in  another 
section.  BIT  failure  activation  must  be  retarded  and  the 
time  delay  specified  for  each  such  related  assembly  during 
the  early  design  phase  of  the  system.  Interchangeability 
requirements  demand  such  considerations. 
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mm.  The  BIT  shall  have  high  reliability  circuits  on  the  order 
of  100,000  hours  MT3F. 

nn.  The  BIT  architecture  and  test  algorithms  shall  be  standard¬ 
ized  throughout  the  weapon  system  equipment. 

oo.  The  BIT  indicators  shall  be  readily  visible  to  the  operator. 

pp.  The  BIT  circuitry  shall  be  resident  on  the  same  functional 
module  in  which  it  is  monitoring  whenever  possible- 

qq.  The  incorporation  of  BIT  shall  make  maximum  use  of  existing 
microprocessors  and/or  computers  vithin  the  system- 

rr.  The  incorporation  of  BIT  into  the  weapon  system  shall  have 
no  effect  on  the  functional  circuitry,  shall  not  effect  the 
safety  of  operation,  and  shall  fail  passively,  i.e.,  be 
fail  safe. 

ss.  Calibration  or  alignment  of  BITE  circuitry  shall  be  limited. 

The  BIT  performance  requirements  in  Paragraph  3.8  contain  additional 
items  to  be  considered  by  the  equipment  designer  when  incorporating  BIT  into 
the  weapon  system. 

4.2  BIT  SPECIFICATIONS  AND  GENERAL  REQUIREMENTS 

The  design  of  BIT  is  a  complicated  process.  BIT  includes  every 
concept  used  to  detect  and  isolate  a  fault  and  provides  a  means  for  check¬ 
ing  the  system  readiness  without  the  use  of  external  test  equipment.  The 
complexity  of  BIT  ranges  from  the  indicator  lamp  that  lights  when  an  equip¬ 
ment  power  switch  is  turned  on  to  the  use  of  a  resident  computer  for  the 
generation  of  test  signals  and  evaluation  of  the  system  response.  BIT  can 
be  continuously  operated,  interleaved  with  other  operations  or  initiated  on 
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command.  It  includes  hardware  sensors,  software,  and  firmware.  Its 
particular  mechanization  and  utilization  in  a  system  are  of  course 
determined  by  the  designer  and  the  system  requirements  resulting  from 
analysis.  The  careless  design  of  BIT  can  result  in  a  near  useless 
system  ignored  by  the  operator  and  maintenance  personnel. 

BIT  can  be  categorized  in  several  different  ways  such  as: 

o  Purpose,  i.e.,  detection,  isolation  correction  and/or 
prediction 

o  Active  versus  passive 

o  Functional  levels  tested 

o  On-line  versus  off-line  versus  interleaved 

o  Inductive  versus  deductive 

o  Centralized  versus  decentralized 

The  result  is  a  matrix  of  possible  BIT  classes  with  each  class 
having  its  use  to  meet  a  designers  particular  need.  In  most  cases  a 
combination  of  classes  will  be  used  as  the  most  cost  effective  means  of 
meeting  specific  requirements.  A  brief  discussion  of  these  six  categories 
of  BIT  follows. 

4.2.1  Purpose 

There  are  two  main  purposes  for  BIT.  One  is  to  detect  a  failure 
which  also  serves  the  function  of  isolation  to  a  specified,  predetermined 
level,  as  an  aid  to  maintenance.  The  other  function  of  BIT  is  to  correct 
a  failure.  This  can  be  accomplished  by  a  failure  triggering  through  BIT 
the  transfer  from  a  failed  module  to  a  redundant  module.  Failure 
prediction  can  also  be  performed  by  BIT  in  such  areas  as  a  vibration 
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level  being  an  indication  of  an  imminent  failure. 

4.2.2  Active  Versus  Passive 

The  interrogation  of  a  module  by  a  test  signal  and  then  evaluates 
the  response  is  an  example  of  active  BIT.  Passive  BIT  would  monitor  system 
performance  without  generating  a  test  signal. 

4.2.3  Functional  Level  Tested 

BIT  can  be  designed  to  test  at  the  system  level,  subsystem  module 
level,  printed  circuit  board,  or  even  the  part  level.  The  level  depends 
on  both  the  maintenance  concept  and  the  resulting  system  level  analysis 
and  the  logistic  support  analysis.  The  maintenance  requirements  and  the 
associated  life-cycle  cost  trade  studies  will  determine  the  appropriate 
functional  level  or  levels  for  BIT. 

4.2.4  On-Line  Versus  Off-Line  Versus  Interleaved 

On-line  passive  BIT  is  in  operation  while  the  system  is  operating. 
Off-line  active  BIT  will  check  the  systems  operation  while  the  system  is 
not  performing  its  mission.  It  is  also  possible  that  the  active  BIT  is  used 
when  the  system  is  operating  but  a  particular  module  is  not  operating;  in 
fact  an  entire  system  can  be  tested  without  interrupting  operation.  This 
is  referred  to  as  interleaving  BIT.  Interleaving  can  be  an  effective 
means  for  maintaining  system  confidence  without  disrupting  a  mission  for 
specific  testing.  BIT  can  be  used  to  indicate  failures,  be  used  to  monitor 
the  well-being  of  the  system,  and  assist  in  locating  a  malfunction.  The 
designer  must  decide  the  combination  of  BIT  required  for  the  specific 
system  based  on  analysis  and  systems  concept. 

4.2.5  Inductive  Versus  Deductive  BIT 

Inductive  BIT  concludes  that  if  a  specific  set  of  measured  functions 
are  within  their  stated  tolerance  limits  then  a  single  unmeasured  function 
must  also  be  within  its  stated  tolerance  limit. 


Deductive  BIT  assumes  that  if  a  certain  function  is  within  a 
stated  tolerance  limit  then  all  the  variables  involved  in  generating 
that  function  must  be  within  their  stated  tolerance  limit. 

4.2.6  Centralized  Versus  Distributed 

Centralized  BIT  would  be  individual  systems  together  with  a 
central  computer  or  microprocessor  which  controls  the  system  and  can 
provide  interleave  tests.  Usually  less  hardware  is  required  in  the 
centralized  BIT. 

If  each  BIT  circuit  has  but  one  function,  such  as  test  one 
module,  it  is  distributed.  Distributed  BIT  has  the  advantage  that  a 
system  can  be  taken  off-line  and  continue  to  use  BIT  for  further  failure 
diagnosis. 

The  most  important  of  all  "General  Design  Requirements"  is  that 
BIT  CANNOT  be  considered  an  afterthought.  As  discussed  in  Section  3.0, 
BIT  must  be  an  integral  part  of  the  design  process  and  be  considered  in 
the  concept  definition  and  included  as  part  of  the  formal  (and  informal) 
analysis . 


Important  general  design  considerations  and  items  that  should 
be  considered  for  inclusion  in  the  specifications  for  BIT  are  the  following 

o  Availability  Requirements 

o  Reliability  Requirements 

o  MTTR 

o  Fault  Definition 

o  Detectability  level 
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o  Fault-Isolation  Level 

o  False-Alarm  Rate 

o  Self-Test  Requirements 

o  Extent  of  Operator  Participation 

o  Software  Constrains  (Memory  Capacity) 
o  Design-Growth  Limits 

o  Design  Cost  Goals 

o  Fail-Safe  Provisions 

o  Fault  Indicators 

o  Special  BIT  Features 

o  Calibration  Requirements 

The  reliability  of  BIT  should  exceed  that  of  the  hardware  being 
tested.  If  this  is  not  the  case,  the  probability  of  failure  of  the  BIT 
may  be  almost  as  great  as  the  probability  of  failure  of  the  unit  under 
test.  A  failure  in  the  BIT  circuit  should  not  affect  the  weapon  system 
performance.  Whenever  feasible,  the  BIT  input  and  output  should  be 
sufficiently  isolated  from  the  normal  channels  so  that  any  failure  in 
the  BIT  will  not  cause  a  system  failure.  The  use  of  high-reliability  and 
bumed-in  parts  as  well  as  integrated  circuits  is  recommended. 

BIT  should  be  kept  as  simple  as  possible  but  be  as  effective 
as  required  to  meet  operational  needs.  The  type  circuitry  use  for  BIT 
should  be,  if  feasible,  the  same  type  used  in  the  basic  system. 
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The  BIT  protective  circuitry  should  be  designed  to  be  fail-safe, 
i.e.,  fail  passively.  As  an  example,  if  a  wire  breaks  or  a  connector  is 
left  disconnected,  the  fault  will  be  detected  and  the  system  protected. 

All  possible  input-stimuli  combinations,  when  economical,  should  be  con¬ 
sidered  to  eliminate  the  possibility  of  a  good  condition  fraudulently 
indicating  a  fault.  Self-test  of  BIT  is  an  important  consideration  since 

an  undetected  BIT  failure  which  incorrectly  indicates  a  system  failure 

* 

will  increase  maintenance  time  by  directing  the  maintenance  personnel  to 
the  wrong  area. 

4.3  TESTABILITY  DESIGN  REQUIREMENTS 

Design  for  testability  (OFT)  is  a  basic  objective  to  be  leviec  as 
a  requirement  by  the  Army  on  all  future  missile  systems.  Improved  operat¬ 
ional  readiness  and  reduced  operating  and  support  costs  can  not  be  realized 
unless  DFT  becon.es  a  contract  requirement  similiar  to  system  performance. 

It  is  difficult  to  specify  reasonable  and  cost-effective  testability  require¬ 
ments  that  can  be  contractually  stated  and  enforced.  The  following  design 
guides  are  generic  in  nature  and  represent  the  typical  standards  that  exist 
throughout  industry.  It  is  suggested  that  they  serve  as  a  basis  for  defining 
testability  design  requirements  for  both  the  designer  and  the  procurement 
activity. 

Module  Layout 

o  Provide  sufficient  space  between  adjacent  components  and 
place  components  in  a  standard  orientation 


Edge  Connector 

o  Utilize  a  standard  connector  with  keying  capability 

o  Use  a  standard  location  for  common  function,  e.g.,  power, 
ground,  and  analog  signals 
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o  Provide  adequate  edge  connector  pins  for  the  control  and 
visibility  of  the  circuits 

o  Ensure  that  adjacent  connector  pins  cannot  short  and  cause 
damage  to  the  circuitry  on  the  modules 


Partitioning 

o  Design  modules  into  easily  testable  functional  partitions  - 
do  not  divide  functions  between  two  or  more  modules 

o  Isolate  analog  and  digital  circuitry 

o  Subdivide  large  logic  circuits  with  low  visibility  into 
partitions 

Test  Points 

o  Provide  sufficient  test  points  for  fault  diagnosis/visibility 

o  Types  -  DIP  pins,  external  connecter,  stand-offs,  and  pads 

o  Also  consider  space  for  IC  locations,  built-in  multiplexer 

for  selection  of  test  points,  and  shift  registers  to  shift 
out  test  point  data 

Noise  Propagation 

o  Provide  adequate  decoupling  of  voltages  at  each  IC  or  group 
of  IC's  and  at  module  connector 

Supply  Voltages 

o  Minimize  the  number  of  voltage  supplies  per  module 

o  If  more  than  one  voltage  supply,  ensure  that  a  random  turn 

on/off  sequence  will  not  damage  module  circuitry 
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Minimize  logic  families  if  possible;  if  not,  choose 
components  that  are  compatible  both  electrically  and 
mechanically 


Logic  Families 
o 


Input/Output  Interface 

o  Ensure  that  an  additional  60  pF  load  will  not  adversely 
affect  performance  of  modules  during  testing 

o  Provide  minimal  load  on  board  input  signals  and  maximum 
drive  capability  on  output  signals 

o  Buffer  clock  and  reset  lines  along  with  flip-flop  and 
latched  outputs 


Initialization 

o  Provide  reset  (set)  lines  for  efficient  external  initial 
ization  of  memory  elements 

o  Avoid  self-initializing  counter 

o  Avoid  the  connection  of  set  and  clear  inputs  to  the  same 
signal  elements 

Logic  Race  and  Timing 

o  Design  for  worst-case  timing 

o  Avoid  designs  whose  functional  operation  will  involve 
logic  race  and  timing 
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Free-Running  Clocks 

o  Allow  for  the  disablement  of  internal  free-running  clocks 
and  the  insertion  of  an  external  test  clock  signal 

Feedback  Loops 

o  Segment  digital  feedback  loops  on  modules  such  that  during 
testing  the  loops  can  be  opened  and  testing  performed  on 
both  the  segmented  and  closed  loop 

Bused  Logic 

o  Allow  for  visibility  and  control  of  bus 

o  Avoid  use  of  wire  AND's  and  OR's  in  the  circuit  design 

Adjusting  Elements 

o  Avoid  the  use  of  potentiometers  and  adjustable  capacitors 
LSI 

o  Provide  for  the  control  and  visibility  of  all  functions 
associated  with  microprocessors  and  memory  elements 

o  Consider  the  utilization  of  a  socket  for  complex  LSI's 

o  Provide  a  means  for  the  control  of  the  board  activity  rate 

4.4  ENGINEERING  DESIGN  HANDBOOKS 

The  Engineering  Design  Handbook  Series  of  the  Army  are  a  coordinated 
series  of  handbooks  containing  basic  information  and  fundamental  data  useful 
in  the  design  and  development  of  Army  materiel  and  systems.  The  handbooks 
are  authoritative  reference  books  of  practical  information  and  quantitative 
factors  helpful  in  the  design  and  development  of  Army  materiel  so  that  it 
will  meet  the  tactical  and  the  technical  needs  of  the  Army. 


Appendix  A  contains  a  list  of  these  handbooks  as  of  May  1979, 
with  both  the  AMC  Pamphlet  number  and  the  Defense  Documentation  Center* 
and  National  Technical  Information  Service  (DDC/NTIS)  document  number. 

4. 5  REDUNDANCY 

Design  for  redundancy  must  consider  the  criticality  of  the 
function  to  a  particular  mission  or  operation  as  well  as  the  impact  on  maint¬ 
ainability,  testability,  and  program  life-cycle  costs. 

The  existing  technology  of  large-scale  integration  (LSI)  circuits 
allows  for  easy  incorporation  of  redundancy  as  well  as  BIT  into  a  new 
design  without  an  appreciable  impact  on  weight,  size,  and  even  component 
cost.  Prior  to  the  integrated  circuits,  cost,  weight,  and  size  were  a 
deterrent  to  incorporating  redundancy.  In  existing  equipment,  including 
redundancy  would  in  all  probability  prove  to  be  very  costly. 

A  trade-off  analysis  must  be  performed  to  establish  the  redundancy 
for  a  particular  electronic  design.  The  criteria  which  will  impact  the 
trade-off  decision  to  incorporate  redundancy  at  either  the  system  level  or 
the  circuit  or  function  level  are: 

o  Reliability  requirements 

o  Mission  essential  functions  and  availability  criteria 
o  Minimum  level  of  allowable  degraded  modes 
o  Backup  requi rements ,  either  manual  or  automatic 

o  Maintainability  requirements 
o  Testability  limitations 


*  DDC  is  now  called  the  Defense  Technical  Information  Center  (DTIC) 
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o  Human  factors  including  available  skill  level  of  personnel 
for  maintenance,  in  particular  at  the  Organizational  level 

o  Weight,  size,  and  cost 

o  Impact  on  circuit  functions  including  electromagnetic 
interference 

o  Logistic  support  including  spare  requirements 

Incorporation  of  redundancy  at  the  system  level,  the  function 
level,  the  unit  level  or  the  component  level  should  not  be  an  arbitrary 
decision  by  a  designer  but  should  be  subjected  to  a  deliberate  and  formal 
review,  coordinated  with  and  part  of  an  overall  systems  and  logistic  support 
analysis. 

Redundant  circuits  may  be  active  or  passive.  In  either  case, 

BIT  should  be  utilized  to  provide  the  following: 

o  Provide  a  performance  evaluation  of  both  circuits. 

o  Provide  information  to  the  system  operator  that  one  of 
the  redundant  circuits  (or  systems,  components,  etc.) 
has  failed.  This  information  should  be  provided  even 
if  there  is  an  automatic  switch-over  from  one  circuit 
to  the  other. 

o  Provide  information  to  the  operator  if  there  is  a 
deterioration  in  one  of  the  circuits. 

In  the  event  computer  software  is  used  to  provide  voting 
functions  and  to  indicate  automatic  transfer  between  redundant  circuits, 
the  data  processing  design  must  take  into  account  the  expanded  memory 
requirements. 


4.6  FAULT  TOLERANCES 

A  circuit  analysis  should  be  conducted  to  determine  the  accept¬ 
able  tolerance  levels  for  each  electronic  unit.  Use  of  a  nominal  fault 
tolerance  parameter  measurement  for  all  levels  of  testing  will  not  be 
acceptable.  It  will  be  necessary  to  take  into  account  the  tolerance 
limits  of  each  functional  chain,  thereby  providing  for  the  allowable 
cumulative  variations  at  the  various  levels  of  maintenance  and  repair. 
Figure  1  represents  this  tolerance  cone  or  tree. 

The  functional  tolerance  limits  of  each  test  level  shall  be 
assigned  early  in  the  design  phase  and  reviewed  in  conjunction  with  the 
level  of  repair  identified  by  both  the  LSA  and  the  maintenance  concept. 

4.7  BUSING  AND  SIGNAL  FAN-OUTS 

Busing  and  signal  fan-outs  may  be  necessary  in  circuit  designs 
to  allow  for  multiple  source/sync  signal  conditioning  and  logic  transfers. 
Busing  techniques  are  commonly  used  in  interface  communi cations  between 
subsystems  and  internal  to  the  electronic  units  for  such  things  as  power, 
grounding,  enabling  circuits,  sync  or  clock  signals  and  the  like. 

Testability  and  ambiguity  considerations  are  largely  influenced  by 
this  design  feature,  and  special  attention  needs  to  be  given  in  the  in¬ 
corporation  of  BIT  so  that  unambiguous  isolation  of  the  fault  can  be  deter¬ 
mined.  Failures  from  circuits  using  common  busing  can  cause  a  large  group 
of  fault  indications  involving  many  systems,  subsystems,  and  units.  The 
BIT  designer  must  be  especially  aware  of  this  situation  and  design  BIT  so 
that  the  actual  fault  is  isolated  to  the  specific  unit. 

The  8IT  capability  for  circuits  such  as  power  sources,  clock 
circuits,  sync  signals,  etc.,  should  be  designed  so  that  the  specific 
signal  can  be  monitored  independent  of  the  functional  circuit.  This  can 
be  accomplished,  through  automatic  initiation  by  BIT,  to  isolate  the  signal 
at  its  source. 
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Often  the  failed  condition  can  be  isolated  in  a  power-off  state 
through  resistance  measurements.  This  type  testing  for  fault  isolation 
lends  itself  to  the  off-line  testing  using  ATE  or  manual  test  equipment. 

The  designer  of  BIT  must  consider  the  need  for  external  testing  and  be 
compatible  with  it. 

Failures  resulting  in  loaded,  shorted,  or  open  conditions  present 
a  different  situation  where  testing  at  the  signal  source  will  not  isolate 
the  failure  should  the  fault  be  downstream  from  the  source.  Again  the 
designer  incorporating  BIT  must  consider  this  situation.  Assuming  a 
centralized  computer,  software  programming  can  readily  isolate  the  fault. 

4.8  SOFTWARE  VERSUS  HARDWARE 

Today's  technology  favors  the  computer  or  microprocessor  and 
software  approach  over  that  of  hardware  especially  as  related  to  traditional 
analog  circuitry.  Many  of  the  current  hardware  functions  have  been  reduced 
to  software  algorithms  and  transfer  functions. 

Software  plays  an  important  role  in  testability  designs  and  can 
offset  the  added  production  cost  of  a  hardware  approach.  While  the  software 
up-front  costs  may  be  high,  it  is  foolproof  once  developed,  and  over  the 
life  of  the  program  can  be  cost  effective  resulting  in  a  lower-life  cycle 
cost. 


Once  the  decision  has  been  made  that  BIT  will  be  included  in  the 
weapon  system  and  the  level  of  BIT  defined,  it  must  then  be  determined  to 
what  extent  hardware  and/or  software  will  be  used  in  implementing  the  BIT 
system. 


Hardware  in  the  form  of  hardwire  has  its  place  in  BIT.  An  example 
would  be  a  power-on  indicator  light.  Hardwire  logic  circuits  are  standard 
in  many  circuits,  and  even  with  a  more  sophisticated  software  approach,  the 
use  of  hardwire  in  a  BIT  system  has  its  application.  A  drawback  using  a 
straight  hardware  approach  is  that  fault  isolation  requires  that  the  operator 
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(Organizational  level)  or  maintenance  personnel  be  provided  procedures 
ana  troubleshooting  aids  as  BIT  in  this  situation  will  not  necessarily 
fault-isolate  to  a  replaceable  unit. 

Software  on  the  other  hand  offers  many  advantages.  Software, 
of  course,  implies  using  a  computer  or  microprocessor.  Many  weapon  systems 
contain  a  computer  for  its  operational  functions.  In  this  situation,  if 
the  computer  can  be  shared  between  the  operational  and  test  functions,  the 
cost  associated  with  including  BIT  can  be  minimized.  In  those  cases  where 
a  system  computer  is  not  available,  the  microprocessor  can  be  a  very  cost 
effective  approach. 

The  software  approach  for  BIT  offers  many  advantages.  It  can 
offer  a  complete  system  check  automatically,  including  fault-isolation 
to  the  RU  level.  In  addition,  the  software  can  be  modified  to  accommodate 
system  changes.  With  software  there  is  the  additional  capability  of  a 
memory  system  which  can  be  useful  in  identifying  a  system  (or  component) 
deterioration  prior  to  failure.  This  aspect  of  using  software  can  provide 
the  designer  with  a  very  powerful  test  tool. 

Several  considerations  should  be  kept  in  mind  when  designing  a 
BIT  system  using  software. 

o  It  is  essential  to  isolate  the  system  data  from  the  test 
data.  This  is  true  for  both  the  input  as  well  as  the 
output.  If  the  test  signals  are  not  inhibited  at  the 
output,  they  may  be  misinterpreted  by  the  interfacing 
hardware  as  a  command  or  as  fraudulent  data. 

o  When  monitoring  the  output  of  a  given  functional  area,  it 
is  essential  to  provide  adequate  tolerance.  The  amount  of 
tolerance  will  depend  upon  the  specific  application. 
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o  The  input  stimuli  should  be  kept  at  a  minimum  level  to 
minimize  their  effect  upon  performance.  Input  stimuli 
should  be  chosen  to  closely  resemble  normally  accepted 
data.  Therefore,  if  data  are  supplied  inadvertently  to 
an  interfacing  unit,  a  malfunction  will  not  be  created 
in  that  unit.  Also,  stimuli  should  not  be  selected  so 
as  to  cause  fraudulent  commands  which  might  be  detri¬ 
mental  (i.e.,  firing  commands,  etc.). 

o  Existing  data  networks  should  be  used  whenever  possible. 

This  will  greatly  reduce  cost  and  also  provide  testing 
of  interface  circuitry. 

o  The  key  optimized  fault  isolation  is  judicious  selection 

of  monitoring  points.  Whenever  possible,  a  common  monitor¬ 
ing  point  should  be  utilized  to  test  more  than  one 
functional  area. 

o  The  possible  increase  in  computer  size  which  may  be  necessary 
for  the  inclusion  of  BIT  must  be  considered  when  initially 
designing  the  total  system. 

4.9  MICROPROCESSOR  AND  BIT 

The  addition  of  special  circuits  to  a  complex  system  for  the 
purpose  of  performing  SIT  has,  as  a  goal,  the  detection  and  diagnosis  of 
faults.  If  the  system  design  objective  is  a  long-term  MTBF  then  the  BIT 
information  can  be  used  to  switch  to  a  good  spare.  The  system  designed 
to  provide  a  low  MTTR  can  use  BIT  information  to  pin-point  the  failed  part. 

The  microprocessor  is  an  attractive  candidate  for  use  in  3IT 
applications  since  it  offers  the  potential  for  a  flexible  approach  to 
testing  as  well  as  a  means  of  standardizing  BIT  hardware  over  a  wide 
range  of  modules.  The  microprocessor  may  be  used  for  such  things  as 
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parity  and  other  code  comparisons  as  well  as  statistical  characterization 
and  dynamic  signal  verification. 

The  incorporation  of  BIT  is  a  useful  approach  in  meeting  the 
reliability  and  testability  goals  established  for  the  system.  The 
ability  to  accurately  evaluate  total  life-cycle  costs  will  determine 
if  the  microprocessor  can  be  applied  as  an  effective  BIT  element. 
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SECTION  5.0 
COMMUNICATION  SYSTEMS 


5.1  DESIGN  OBJECTIVES 

The  primary  objective  of  designing  a  buil t-in-test  (BIT) 
capability  into  the  communication  sections  of  a  weapon  system  is  to 
increase  the  probability  that  required  informational  transfers  will  be 
accomplished  within  the  proper  time  periods.  This  goal  is  reached  by 
maintaining  the  current  status  of  all  functional  elements  in  the 
communication  system  so  that  alternative  routings  can  be  selected  if 
performance  degradations  or  failures  should  occur. 

Additional  benefits  expected  from  the  inclusion  of  BIT  are: 

o  Reduction  of  the  possibility  that  information  may  be  mis¬ 
interpreted  due  to  degradation  or  failure  of  elements  in 
the  communications  link. 

o  Improvement  in  the  MTTR  of  the  system. 

o  Provision  of  failure  information  to  assist  and  speed  the 
repai r  of  problems. 

5.2  COMMUNICATION  SYSTEMS  SPECIAL  CONSIDERATIONS 

Communication  systems  interface  with  most  of  the  other  sections 
of  a  weapon  system  and  handle  a  variety  of  data.  They  operate  with 
frequencies  as  high  as  light  waves  and  as  low  as  dc,  with  power  levels 
from  microwatts  to  megawatts.  This  can  make  it  difficult  to  verify  the 
proper  operation  of  some  areas.  However,  most  areas  can  be  checked 
through  the  careful  selection  of  sensors  and  associated  circuitry  or  by 
inference  through  the  operation  of  interfacing  stages. 


Often  the  communication  links  between  various  elements  of  a 

weapon  system  will  consist  of  multiple  channels,  many  of  which  perform 

similiar  functions.  This  offers  a  redundancy  potential  that  usually  is 

not  available  with  other  systems.  However,  to  properly  utilize  this 

potential  the  overall  system  must  be  designed  for  that  type  operation 

and  needs  a  BIT  capability  to  assist  operator  control  of  data  routing. 

If  automatic  operation  of  the  system  is  intended,  then  BIT  is  required 

in  order  for  the  system  to  function.  It  may  not  be  identified  as  such 

by  the  designed  and  may  not  provide  complete  indicator  outputs,  but  the 

monitoring  and  fault  detection  circuitry  must  be  there  to  enable  auto- 

♦ 

matic  transmission  link  selection. 

As  the  complexity  of  weapon  systems  increases,  the  nu  ber  of 
data  channels  required  also  increases.  Because  many  of  these  channels 
are  functionally  similiar  and  do  not  require  full  time  data  flow,  it 
becomes  feasible  to  multiplex  some  of  the  data  channels  and  reduce  t:  e 
number  of  transmission  circuits.  This  creates  a  unique  situation  for 
BIT  since  a  single  test  point  can  be  used  to  monitor  several  data 
channels.  The  evaluation  of  the  signals  from  this  test  point  can  be 
quite  complex  and  could  require  elaborate  and  costly  circuitry  if  per¬ 
formed  conventionally.  However,  the  availability  of  inexpensive  micro¬ 
processors  provides  an  excellent  method  of  performing  this  task  along 
with  other  BIT  functions  if  desired.  There  may  already  be  microprocessors 
in  the  weapon  system  with  spare  capability  that  could  be  utilized  for 
this  or  other  similiar  BIT  requirements. 

Communication  systems  quite  often  are  spread  over  large  areas 
with  different  sections  separated  by  considerable  distances,  thus  making 
it  difficult  to  perform  certain  tests.  For  example,  it  may  not  be 
feasible  to  transmit  a  test  pattern  over  a  circuit  and  back  to  the 
origin  for  checking  in  real-time  since  this  would  require  a  separate 
return  circuit.  It  may  be  necessary  to  store  the  test  pattern  and  send 
it  back  over  the  same  link  for  verification  or  it  may  not  be  possible  to 
perform  the  test. 
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An  additional  unique  characteristic  of  conmuni cation  systems  is 
their  dependence  on  the  ionosphere,  which  is  an  external,  uncontrollable 
factor  for  some  radio  frequency  links.  This  can  produce  a  circuit  that 
operates  intermittently  during  adverse  propagation  conditions,  which 
requires  that  failure  monitoring  circuitry  be  able  to  discern  between 
these  conditions  and  equipment  failure.  Otherwise,  operator  intervention 
will  be  necessary  when  the  link  appears  inoperative. 

5.3  PERFORMANCE  SPECIFICATIONS 

The  design  of  a  communication  system  should  include  BIT  to 
provide  a  quick  and  reliable  indication  of  the  system  status  to  the  user. 
He  needs  to  know  whether  the  system  is  functioning;  and  if  not,  to  what 
degree  its  capability  has  been  degraded.  The  design  of  the  BIT  should 
be  such  that  a  measure  of  the  systems  operation  is  constantly  available 
to  the  user  to  assist  his  operational  decisions. 

To  enable  a  BIT  system  to  be  properly  implemented,  a  valid  set 
of  performance  specifications  must  be  established.  It  is  important  for 
a  failure  to  be  indicated  only  when  the  communication  system  has  experi¬ 
enced  a  hard  failure  or  a  degradation  that  prevents  the  reliable  operation 
of  a  system  element.  A  system  is  normally  designed  to  performance 
specifications  that  exceed  the  operational  requirements  for  the  system 
to  ensure  adequate  performance  after  some  degradation  in  the  field.  This 
allowable  field  degradation  is  usually  part  of  the  performance  specifica¬ 
tions  and  establishes  a  basis  for  setting  BIT  threshold  levels.  The 
performance  of  the  system  may  decrease  below  the  expected  field  degrada¬ 
tion  level  and  still  operate  acceptably.  This  would  be  a  worst  case 
level  of  operation  for  the  system  and  a  better  no-go  threshold  for  BIT. 
This  threshold  must  be  set  at  the  proper  level  because  too  high  a  setting 
would  generate  excessive  failure  indications  and  result  in  unnecessary 
maintenance.  Conversely,  a  BIT  threshold  level  that  is  too  low  could 
allow  a  system  to  degrade  below  an  acceptable  operational  level  and  be 
unable  to  accomplish  its  mission  before  a  failure  is  indicated. 


Threshold  levels  are  more  often  applied  to  analog  circuits 
because  they  generally  exhibit  a  graceful  degradation  of  performance 
with  time.  Digital  circuits  usually  operate  properly  or  not  at  all. 
However,  in  data  transmission  over  communication  circuits  the  error  rate 
can  increase  gradually  until  it  crosses  a  threshold  of  useability.  A 
measure  of  this  error  rate  can  provide  a  good  overall  digital  circuit  test. 

5.4  ENVIRONMENTAL  REQUIREMENTS 

When  BIT  circuits  are  being  designed  and  BIT  threshold  levels 
are  being  established,  consideration  must  be  given  to  effects  produced 
by  the  operational  environment.  This  should  include  not  only  temperature, 
humidity,  shock,  and  vibration  but  also  susceptibility  to  radiated  and 
conducted  electromagnetic  energy.  Since  some  communi cation  systems 
utilize  high  power  transmitters,  the  BIT  circuitry  may  be  subjected  to 
sufficient  energy  levels  to  shift  their  operating  points  and  cause  false 
indications  of  failure  or  inability  to  detect  actual  failures.  Electro¬ 
magnetic  environmental  requirements  should  be  specified  so  that  designers 
can  include  the  necessary  shielding,  filtering,  and  packaging  to  prevent 
operational  problems. 

5.5  BIT  CONSIDERATION 

Implementing  BIT  in  communication  systems  requires  consideration 
of  many  of  the  same  factors  that  must  be  evaluated  for  the  other  sections 
of  a  weapon  system.  In  addition,  elements  peculiar  to  communication 
systems  must  be  considered,  such  as  whether  or  not  to  measure  the  noise 
level  of  a  receiver.  Trade-offs  will  be  necessary  between  the  percentage 
of  BIT  coverage,  the  added  reliability  introduced,  the  improved  maintain¬ 
ability,  and  the  cost  of  the  additional  circuitry. 

5.5.1  BIT  Coverage 


It  is  common  practice  to  replace  entire  systems  or  subsystems 
when  a  failure  is  detected  during  testing.  This  is  usually  required 
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because  the  level  of  instrumentation  is  not  adequate  to  isolate  the 
failure  to  a  module  within  a  system.  One  result  of  this  is  a  costlier 
spares  inventory. 

Figure  2  shows  a  typical  data  receiver  block  diagram.  This 
receiver  could  be  constructed  on  one  circuit  board,  but  more  likely  it 
would  be  divided  into  two  or  three  sections.  A  typical  arrangement 
would  have  blocks  A,  B,  and  C  on  one  board,  blocks  D,  E,  F,  and  G  on 
a  second  board,  and  block  H  on  a  third.  If  each  board  is  properly 
instrumented,  a  failure  could  be  isolated  to  a  single  board  and  only 
that  board  replaced.  Otherwise,  the  entire  receiver  would  be  replaced. 

The  extent  to  which  BIT  is  implemented  can  be  carried  below 
the  circuit  board  level  if  desired.  For  example,  if  board  one  for  the 
receiver  in  Figure  2  consists  of  blocks  A,  B,  and  C,  it  might  be 
instrumented  at  points  1  through  5.  A  failure  in  the  oscillator 
(block  C)  would  cause  improper  readings  at  points  4  and  5.  the  board 
would  be  replaced  at  the  organizational  level  and  the  failure  indication 
passed  along  to  the  direct  support  organization  to  assist  in  its  repair. 

The  percentage  of  coverage  for  BIT  is  determined  through 
coordination  of  the  failure  mode  analysis,  the  weapon  system  maintenance 
plan,  and  interrelated  cost  considerations. 

5.5.2  BIT  Self- Test 

Testing  of  BIT  circuitry  can  be  accomplished  in  several  ways. 
One  of  the  better  approaches  is  to  build  into  the  circuits  the  capability 
for  self-testing.  In  most  BIT  monitors  a  test  input  or  a  control  lead 
can  be  added  which  will  allow  the  circuit  to  be  actuated  externally, 
thus  verifying  its  operation  from  that  point  out  to  the  indicator.  For 
analog  input  circuits  the  test  input  can  sometimes  be  the  input  used 
for  calibrating  the  circuit.  Figure  3  shows  possible  circuits  with 
self-test  inputs  for  analog  and  digital  BIT  monitors. 
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figure  2.  Typical  Data  Receiver  Block  Diagram 
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Manual  or  automatic  testing  of  BIT  circuits  can  be  utilized 
depending  on  the  particular  weapon  system  design  philosophy.  If  a  central 
computer  is  used  to  control  the  BIT  system,  then  a  desirable  mode  of 
operation  would  be  for  the  computer  to  sequentially  actuate  the  test 
input  to  each  monitor  and  verify  its  output.  An  alternative  would  be 
to  actuate  all  monitors  simultaneously  and  scan  each  one  for  the  proper 
output.  Manual  testing  of  the  BIT  circuits  can  be  accomplished  by 
applying  the  input  stimuli  manually  and  verifying  that  correct  outputs 
occur.  In  either  case,  outputs  of  BIT  circuits  which  control  events  such 
as  shutting  off  power  due  to  overvoltage  must  be  disabled  during  testing. 

5.5.3  Fail-Safe 

BIT  circuitry  should  be  designed  to  be  as  fail-safe  as  practical. 

The  monitor  input  should  be  configured  so  that  a  high  level  represents 
normal  operation  and  a  low  level  represents  a  failure.  A  loss  of  signal 
into  the  monitor  would  produce  a  low  input  and  a  failure  indication. 
Therefore,  a  bad  connector,  a  broken  wire  or,  in  some  cases,  a  short 
circuit  would  also  appear  as  a  fault  to  the  BIT  system. 

Other  fail-safe  possibilities  include  the  use  of  redundant 
circuits  and  voting  circuits.  Because  of  requiring  additional  hardware, 
these  approaches  would  probably  be  used  only  in  critical  areas  or  where 
high  reliability  was  specified. 

5.6  COMMUNICATION  SYSTEMS 

A  comnuni cation  system  is  used  to  transmit  control  and  data 

signals  between  the  various  elements  of  a  weapon  system.  These  signals 
will  primarily  be  digital  and  can  be  carried  over  cable  links  and  air 
links.  Digital  data  is  transmitted  in  either  a  parallel  or  a  serial  format 
The  parallel  formal  requires  a  circuit  for  each  bit  in  a  data  word  and 
generally  uses  a  second  group  of  parallel  circuits  for  management  functions 
This  type  of  data  bus  is  often  used  by  a  computer  central  processing 
unit  to  interface  with  other  equipment  and  is  useable  to  a  maximum 
distance  of  about  15  meters. 
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Only  one  circuit  is  required  for  transmission  of  data  in  a 
serial  format.  Data  bits  are  transmitted  sequentially  along  with 
additional  bits  for  protocol  functions  and  error  detection,  when  used. 

When  more  than  one  channel  of  data  is  required,  several  possibilities 
exist.  If  time  permits,  each  channel  can  be  sent  in  sequence  over  a 
single  circuit.  When  simultaneous  transmission  is  required,  a  separate 
circuit  can  be  used  for  each  channel  or  all  channels  can  be  multiplexed 
onto  a  single  or  minimum  number  of  circuits. 

Most  communication  links  utilize  radio  frequency  emissions, 
metallic  conductor  cables,  or  fiber  optic  cables  to  convey  information 
between  locations.  RF  links  are  used  for  long  distances  and  for  communi¬ 
cating  with  moving  vehicles.  Metallic  conductor  cables  have  traditionally 
been  used  for  interconnections  between  fixed  points.  However,  fiber 
optic  cables  are  being  used  increasingly  because  of  their  light  weight, 
wide  bandwidth,  and  resistance  to  interference. 

5.7  ERROR  DETECTION 

Several  techniques  are  available  to  detect  errors  in  transmitted 
data.  One  method  requires  repetitive  transmission  and  comparison  of  each 
character.  Voting  logic  can  then  be  used  for  corrections.  An  obvious 
disadvantage  to  this  method  is  the  increase  in  transmission  time  required. 

The  most  commonly  used  method  is  the  parity  bit.  By  adding  a 
bit  at  the  end  of  each  data  word,  all  words  can  be  made  to  have  an  odd 
(or  even)  number  of  logic  “ones".  Any  word  that  deviates  from  this 
pattern  has  an  error.  No  information  is  included  for  correcting  errors 
so  retransmission  of  bad  words  or  the  entire  message  may  be  necessary 
when  errors  occur. 
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Another  technique  for  detecting  errors  is  transmission  of  the 
data  back  to  the  sender  for  verifying.  This  can  be  accomplished  over 
the  same  circuit  when  the  quantity  of  data  and  time  constraints  allow. 
Otherwise,  a  second  circuit  will  be  required. 

5.8  SPECIFIC  EQUIPMENT  APPROACHES 

5.8.1  Modems 

Modems  are  used  at  each  end  of  data  circuits  to  interface 
between  interconnecting  cables  and  user  equipment  when  long  cables  are 
involved.  They  contain  the  circuitry  needed  to  convert  data  into  audio 
frequency  signals,  one  for  a  logic  "1"  and  another  for  a  logic  "0",  for 
transmission  over  cables,  and  circuitry  to  convert  back  to  logic  levels 
for  reception.  They  also  contain  circuitry  for  operational  control 
such  as  end-of- transmission  detection. 

Modems  are  used  for  full  duplex  and  for  half  duplex  circuits. 

A  full  duplex  circuit  uses  different  audio  tones  for  send  and  receive 
which  allows  simultaneous  transmission  in  both  directions.  A  half 
duplex  circuit  uses  the  same  frequency  tones  for  send  and  receive  and 
therefore  only  operates  in  one  direction  at  a  time. 

A  full  duplex  circuit  can  be  tested  by  transmitting  a  known 
message  over  the  system  and  back  to  the  origin  for  checking.  This  would 
be  done  in  a  test  mode  and  would  verify  the  send  and  receive  functions 
at  each  end  of  the  cable.  A  half  duplex  circuit  can  be  tested  in  a 
similar  manner  except  the  message  must  be  stored  at  the  remote  end  and 
then  transmitted  back  to  the  origin.  Continuous  testing  of  just  the 
modems  can  be  accomplished  by  the  addition  of  some  circuitry.  When  a 
modem  is  transmitting,  a  receiver  could  convert  the  audio  frequencies 
back  to  digital  data  for  comparison.  When  a  modem  is  receiving,  a 
second  receiver  could  operate  in  parallel  with  the  modem  receiver  and 
their  outputs  compared. 
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5.8.2 


Line  Drivers  and  Receivers 


Line  drivers  ard  receivers  are  used  to  transfer  data  over  cables 
up  to  approximately  1  kilometer  long.  The  maximum  allowable  distance  is 
a  function  of  the  data  rate  and  environment.  Line  drivers  and  receivers 
are  available  in  two  distinct  groups;  one  for  unbalanced  lines  and  the 
other  for  balanced  lines.  The  unbalanced  drivers  and  receivers  evolved 
from  standard  logic  circuits  and  operate  with  data  signals  on  a  single 
line  referenced  against  system  ground.  Balanced  line  drivers  accept 
normal  logic  inputs  and  generate  differential  outputs  while  balanced  line 
receivers  reverse  the  process.  The  differential  signal  does  not  depend 
on  system  ground  for  a  reference,  so  it  provides  good  rejection  to  common 
mode  noise  and  level  shifts  of  the  ground  system  between  each  end  of  the 
li  ne. 


The  best  test  of  a  complete  circuit  is  the  loopback  test  where 
the  data  is  returned  to  the  origin  for  verification.  This  of  course 
requires  a  second  circuit  for  real-time  testing  or  storage  if  the  same 
circuit  carries  the  data  in  both  directions.  The  individual  line  drivers 
and  receivers  could  be  continuously  monitored  but  any  reliability  increase 
would  not  be  worth  the  increase  in  complexity.  Therefore,  this  approach 
is  not  recommended. 


5.8.3  Encoders  and  Decoders 

An  encoder  is  used  to  convert  data  into  special  formats,  such  as 
Manchester,  to  increase  the  resistance  to  noise  or  to  improve  synchro¬ 
nization  and  clock  regeneration  at  the  receiving  end.  A  decoder  performs 
the  reverse  by  converting  data  back  from  a  special  format  to  non-retum- 
to-zero  (NRZ) .  Regeneration  of  a  clock  signal  in  synchronization  with 
the  data  stream  is  also  generally  performed  by  the  decoder  circuitry. 


Testing  of  encoders  and  decoders  can  be  performed  separately  or  as 
part  of  the  cortmuni cation  circuit.  The  complete  circuit  can  be  tested 
using  the  loopback  method  where  the  received  data  is  returned  to  the  origin 
for  verification.  This  type  of  testing  may  not  be  feasible  except  in  a 
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test  mode.  Continuous  testing  of  an  encoder  could  be  performed  by  decod¬ 
ing  its  output  and  comparing  this  with  the  input  data  stream.  A  decoder 
could  be  tested  continuously  by  paralleling  a  second  decoder  and  comparing 
the  two  outputs. 

5.8.4  Recei  vers 

A  block  diagram  for  a  receiver  configured  for  receiving  data  is 
shown  in  Figure  2.  This  receiver  could  logically  be  divided  into  three 
sections  with  blocks  A,  B,  and  C  on  one  circuit  board,  blocks  D,  E,  F, 
and  G  on  a  second  circuit  board,  and  block  H  on  a  third  circuit  board. 

Test  points  1  through  11  are  identified  as  possible  BIT  monitor  points. 

Due  to  the  frequencies  and  amplitudes  involved,  some  of  these  test 
points  will  be  very  sensitive  to  any  additional  circuitry.  Test  points 
1  and  2  are  especially  sensitive  and  are  not  recommended  for  BIT 
moni  tori  ng. 

The  outputs  of  the  first  and  second  oscillators  can  be  monitored 
by  simple  RF  detector  circuits  which  would  convert  the  signals  into  dc 
levels  proportional  to  their  amplitudes.  The  dc  would  then  go  to 
level  detectors  that  would  generate  fault  indications  if  the  signals  fell 
below  present  values.  If  the  receiver  is  intended  for  operation  on 
more  than  one  channel,  the  first  oscillator  could  have  an  external 
frequency  control  input.  If  it  is  desired  to  verify  that  the  oscillator 
switched  to  the  proper  frequency,  then  a  much  more  complex  BIT  circuit 
would  be  necessary.  One  possibility  is  a  discriminator  with  a  dc  output 
proportional  to  the  input  frequency.  This  output  would  no  to  the  input 
of  a  comparator  with  a  trip  point  controlled  by  the  frequency  control 
input  to  the  oscillator. 

The  output  of  the  first  mixer,  test  point  5,  will  be  a  low  level 
signal  and  will  need  amplification  before  a  simple  amplitude  detector  can 
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be  used.  However,  integrated  circuits  are  available  that  were  designed 
as  IF  amplifier-audio  detectors  and  should  be  suitable  for  converting  the 
mixer  output  to  a  dc  level  that  can  be  connected  directly  to  a  comparator. 
A  failure  will  be  indicated  when  an  input  signal  to  the  receiver  is  not 
present. 

The  outputs  of  the  first  IF,  the  second  mixer,  and  the  second 
IF  should  have  sufficient  amplitudes  so  that  simple  detectors  can  be 
used  to  convert  the  signals  to  dc  levels.  These  levels  should  then  be 
compared  to  reference  values  to  verify  that  adequate  signals  are  present. 
Again,  a  failure  will  be  indicated  when  an  input  signal  to  the  receiver 
is  not  present. 

The  demodulator/bit  synchronizer  shown  in  block  H  is  similar  to 
the  receive  half  of  the  modems  described  in  paragraph  5.8.1.  The  usual 
input  is  two  audio  frequency  tones  which  must  be  converted  into  serial 
digital  data.  A  clock  signal  is  generated  and  synchronized  with  the 
incoming  data  in  the  bit  synchronizer  portion.  As  with  the  modem,  it  is 
necessary  to  duplicate  the  circuitry  and  compare  the  two  outputs  to 
verify  proper  operation. 

5.8.5  Transmitter 

A  block  diagram  for  a  typical  data  transmitter  is  shown  in 
Figure  4.  Many  variations  are  possible  in  the  exact  way  the  functions 
are  accomplished  but  the  general  arrangement  should  be  similar.  A  power 
supply  is  not  shown  but  would  be  necessary  to  provide  the  proper  voltages. 
This  supply  would  be  monitored  with  BIT  circuits  as  described  in  Section 
8.0  of  this  design  guide. 

The  numbered  test  points  on  the  block  diagram  are  possible 
measurement  locations  for  BIT  monitors.  A  simple  detector  circuit  to 


Figure  4.  Typical  Data  Transmitter  Block  Diagram 


convert  the  signals  to  dc  levels  can  be  used  at  locations  2,  3,  4,  5,  7, 

8,  10,  and  11.  The  dc  levels  would  then  be  measured  by  threshold  detec¬ 
tors  to  verify  that  the  signals  exceed  minimum  requirements. 

The  tone  generator  shown  in  block  A  is  similar  to  the  transmit 
portion  of  the  modem  described  in  paragraph  5.8.1,  and  for  the  most 
effective  results,  should  be  tested  the  same  way.  This  would  require  that 
a  demodulator  circuit  convert  the  output  at  test  point  2  back  to  a  digital 
signal  for  comparison  with  the  input.  A  simpler  test  that  would  only 
verify  the  amplitude  of  an  output  at  test  point  2  would  be  performed  as 
described  in  the  preceding  paragraph. 

If  the  transmitter  is  intended  for  operation  on  more  than  one 
channel,  the  second  oscillator  (block  F)  could  have  an  external  frequency 
control  input.  Verification  that  the  oscillator  switches  to  the  proper 
frequency  will  require  more  complex  BIT  circuitry.  One  possibility  is  a 
discriminator  with  a  dc  output  proportional  to  the  input  frequency.  This 
output  would  go  to  the  input  of  a  comparator  with  a  trip  point  controlled 
by  the  frequency  control  input  to  the  oscillator. 

The  directional  coupler  (block  J)  produces  two  dc  outputs;  one 
proportional  to  forward  power  and  the  other  proportional  to  reflected 
power.  The  difference  in  these  two  parameters  is  a  measure  of  the  output 
from  the  power  amplifier  in  block  I.  The  signals  from  the  directional 
coupler  are  used  by  the  output  control  circuit  to  maintain  a  constant 
power  level  out  of  the  transmitter  and  to  protect  the  power  amplifier. 

This  is  accomplished  by  reducing  the  output  as  a  function  of  the  reflected 
power,  which  is  an  indication  of  a  problem  with  the  coaxial  cable  or 
antenna . 


The  directional  coupler  outputs  should  be  monitored  by  BIT 
circuitry.  This  will  require  amplifiers  because  these  outputs  are  generally 
less  than  1  volt  in  amplitude.  If  the  transmitter  design  does  not  include 
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blocks  J  and  K,  a  directional  coupler  should  be  added  for  the  BIT  circuit. 

An  indication  of  the  transmitter  output  can  be  obtained  from  an  RF  detector 
connected  to  test  point  12,  but  this  is  not  the  recommended  approach. 

5.8.6  Antennas 

Communication  system  antennas  will  generally  be  fixed  with 
omnidirectional  patterns  or  directional  with  a  mechanical  positioning 
system.  BIT  can  monitor  to  verify  that  positioning  systems  respond  prop¬ 
erly  to  movement  coirmands.  The  output  of  the  selsyn  at  the  antenna  can 
be  compared  with  the  command  to  determine  if  the  proper  movement  is  indi¬ 
cated.  This  method  assumes  that  the  antenna  selsyn  is  operating  correctly. 
If  verification  of  the  selsyn  is  also  desired  then  a  separate  position 
monitoring  device,  such  as  a  gear-driven  potentiometer,  can  be  added. 

Antennas  should  be  matched  to  the  impedance  of  the  coaxial  cable 
and  both  the  receiver  and  transmitter.  With  a  receiver  it  is  not  a 
cirtical  factor,  and  a  change  in  impedance  will  only  result  in  a  decrease 
in  received  signal  strength.  However,  with  a  transmitter  a  mismatch 
will  cause  power  to  be  reflected  back  to  the  transmitter  which  can  damage 
the  output  stage.  If  the  transmitter  has  a  directional  coupler  in  the 
output  it  can  be  used  to  monitor  the  antenna  system.  If  not,  one  should 
be  added  so  that  reflected  power  and  its  relation  to  forward  power  can 
be  continuously  monitored.  A  threshold  should  be  established  for  indicating 
a  failure  condition  but  the  actual  values  should  be  periodically  recorded. 

By  tracking  these  measurements  the  condition  of  the  antenna  can  be  monitored 
and  the  failure  point  can  be  predicted,  allowing  maintenance  to  be  performed 
at  noncritical  times. 
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SECTION  6.0 

GUIDANCE  AND  CONTROL  SYSTEMS 


The  guidance  and  control  system  is  one  of  the  most  critical 
components  of  a  weapon  system  in  regards  to  system  performance  require¬ 
ments.  The  guidance  and  control  system  must  perform  satisfactorily 
throughout  the  mission,  not  only  to  steer  the  weapon  to  within  the 
lethal  range  from  the  target,  but  also  to  provide  control  over  other 
components  of  the  weapon  system  such  as  the  propellant  system. 

Because  of  its  complexity,  the  guidance  and  control  system  is 
a  prime  candidate  for  incorporation  of  BIT  and  BITE,  primarily  to 
minimize  fault  detection  and  isolation  times  and  thereby  maximize  weapon 
system  readiness  and  availability. 

The  most  widely  used  types  of  guidance  and  control  systems 
are  electronic  (inertial  guidance  and  control  or  radar  tracking), 
electro-optical  (video  or  laser  tracking),  and  infrared  (heat  seeking). 

The  inertial  guidance  and  control  system  is  ideally  suited  for  weapon 
systems  used  against  fixed  targets  when  it  is  desirable  to  have  no  in¬ 
flight  radio  communications  with  the  weapon  system.  The  infrared 
guidance  and  control  system  is  used  against  mobile  and  fixed  targets 
that  emanate  radiation  in  the  infrared  spectrum  or  that  reflect  infrared 
when  illuminated  by  an  external  source.  The  radar,  laser,  and  video 
tracking  systems  are  used  against  either  mobile  or  fixed  targets  that 
do  not  radiate. 

6.1  SYSTEM  OPERATION 

6.1.1  Inertial  Guidance  and  Control  System  Operation 

An  inertial  guidance  and  control  system  is  a  highly  complex 
electro-mechanical  system,  which  continuously  computes  the  vehicle  velocity 
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and  position,  and  the  direction  and  range  to  a  predetermined  target. 

Figure  5  shows  a  typical  inertial  guidance  and  control  system.  The 
heart  of  the  system  is  a  stable  instrument  platform  with  freedom  of 
rotation  about  three  orthogonal  axes.  Each  axis  is  controlled  by  a 
gyro-controlled  servo  loop.  These  servo  loops  maintain  a  desired  plat¬ 
form  attitude  with  respect  to  the  earths  surface.  The  instrument 
platform  holds,  in  addition  to  the  gyros,  accelerometers  to  measure 
vehicle  accelerations  along  each  of  the  platform  axes. 

An  on-board  computer  integrates  the  accelerometer  outputs  to 
obtain  vehicle  velocity  and  distance  from  the  launch  site,  and  provides 
torquing  signals  to  the  gyros  to  maintain  the  proper  platform  orientation. 
By  preprogramming  the  computer  prior  to  launch  with  the  launch  and  target 
coordinates,  the  computer  can  determine  the  vehicle's  present  position 
and  range  and  direction  to  the  target.  The  computer  provides  the  steering 
signals  to  the  vehicle  autopilot  and  can  also  provide  shutdown  signals 
to  the  propellant  system,  based  upon  vehicle  velocity  and  desired  flight 
pattern. 

6.1.2  Radar  Tracking  System  Operation 

A  radar  tracking  system  utilizes  the  reflection  of  electro¬ 
magnetic  radiation  from  the  target  to  determine  range  and  direction  to 
that  target.  Figure  6  shows  a  typical  radar  guidance  and  control  system. 

A  pulse  generator  provides  the  basic  timing  of  the  system;  namely,  the 
pulse  to  control  the  transmit  phase,  and  sync  signals  to  the  computer 
to  determine  the  time  delay  between  transmit  and  receive  signals  and 
to  the  antenna  phase  control.  The  antenna  phase  control  shifts  the 
radiation  pattern  of  the  antenna  between  successive  transmissions.  In 
this  manner,  four  successive  transmissions  will  radiate  in  four  orthogonal 
directions  slightly  displaced  from  the  vehicle  logitudinal  axis.  The 
difference  in  signal  strength  of  the  received  signals  from  these  trans¬ 
missions  is  used  by  the  computer  to  derive  the  direction  of  the  target 
and  to  generate  the  proper  steering  signals  to  the  vehicle  autopilot. 
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Figure  5.  Inertial  Guidance  and  Control  System  Block  Diagram 


6.1.3  Laser  Tracking  System  Operation 

The  laser  tracking  system  operation  is  almost  identical  to 
the  operation  of  the  radar  guidance  and  control  system.  The  major 
differences  are  that  the  radiation  is  in  the  optical  spectrum  instead 
of  the  RF  spectrum,  and  lens  systems  are  used  instead  of  an  antenna. 

6.1.4  Video  Tracking  System  Operation 

A  video  tracking  system,  as  commonly  used  on  air-to-ground 
missiles,  requires  manual  intervention  to  provide  the  steering  signals 
to  the  missile.  A  forward-looking  TV  camera  is  mounted  in  the  nose  of 
the  missile,  and  electrical  outputs  of  the  camera  (sync  and  video  signals) 
are  transmitted  to  the  launch  vehicle  via  radio  link  where  they  are 
displayed  on  a  video  screen  to  the  operator.  The  operator  then  uses  a 
joystick  to  send  the  desired  steering  signals  to  the  missile  via  a 
return  radio  link. 

6.1.5  Infrared  Tracking  System  Operation 

The  infrared  system  is  a  passive-type  guidance  and  control 
system  which  detects  and  tracks  infrared  (heat)  radiation  emanating  from 
the  target  to  steer  the  missile  to  that  target.  The  system  may  also 
be  used  against  targets  that  do  not  generate  infrared  radiation,  provided 
that  a  forward  observation  post  can  illuminate  the  target  with  infrared 
radiation  and  the  target  reflects  a  detectable  portion  of  the  illumina¬ 
tion.  The  heart  of  the  system  is  a  detector  array  capable  of  detecting 
not  only  the  radiation  but  also  the  angular  difference  between  the 
direction  of  the  target  and  the  missile  longitudinal  axis.  In  most 
systems  the  angular  difference  is  measured  in  two  orthogonal  directions, 
transverse  to  the  missile  longitudinal  axis.  The  guidance  computer 
measures  these  angular  differences  and  transmits  steering  signals  to  the 
missile  to  reduce  the  errors  to  zero. 
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6.2  GUIDANCE  AND  CONTROL  SYSTEM  PERFORMANCE  SPECIFICATION 

Since  the  tactical  mission  of  a  guidance  and  control  system 
is  to  control  and  steer  the  weapon  system  to  a  point  which  is  within 
lethal  range  of  the  target,  overall  system  accuracy  is  a  prime  considera¬ 
tion  in  the  establishing  performance  requirements  for  the  guidance  and 
control  system,  along  with  environmental  and  reliability  considerations . 
During  the  conceptual  phase  of  initial  design,  trade-off  studies  must 
be  performed  to  establish  individual  component  performance  criteria 
which  will  satisfy  the  overall  system  performance  requirements. 

6.2.1  Inertial  Guidance  and  Control  System  Performance  Requirements 

The  accuracy  of  an  inertial  guidance  and  control  system  is 
dependent  to  a  great  degree  on  the  performance  of  the  inertial  instruments 
and  their  associated  servo  loops.  Accelerometer  sensitivity  must  be 
sufficient  to  measure  slight  accelerations,  and  the  scale  factor  and 
bias  must  be  controlled  to  minimize  errors  in  determining  velocities 
and  distances.  Critical  parameters  for  the  gyros  are:  sensitivity, 
which  must  be  sufficient  to  prevent  large  platform  pointing  errors  under 
acceleration  and  vehicle  maneuvering;  gyro  drift,  which  must  be  minimized 
to  prevent  accumulative  platform  pointing  errors;  and  torquing  scale 
factor.  Gyro  spin  motor  excitation  must  be  controlled  to  prevent  extraneous 
gyro  drift  from  changes  in  angular  moment.  '  the  gyro  spin  mass.  In 
addition,  the  computational  capabili  rf  „  •»  guidance  computer  must  be 
sufficient  to  determine  vehicle  posicton  and  velocities  to  the  degree 
of  accuracy  required  by  the  mission. 

6.2.2  Radar  Tracking  System  Performance  Requirements 

The  performance  of  a  radar  tracking  system  is  determined  by  its 
maximum  range,  pointing  accuracy,  and  its  range  determination.  The 
maximum  range  is  dependent  on  the  peak  output  power  of  the  transmitter, 
the  receiver  sensitivity,  and  the  frequency  stability  of  both  the 
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transmitter  and  receiver.  The  pointing  accuracy  is  dependent  on  the 
antenna  alignment  and  the  beam  width  or  the  radiation  pattern  of  the 
antenna.  The  accuracy  of  the  range  determination  is  mostly  dependent 
on  the  stability  and  granularity  of  the  timing  circuits,  and  to  a 
lesser  degree  on  the  antenna  beam  width  which  should  be  narrow  enough 
to  minimize  reception  of  all  signals  except  direct  reflection  from  the 
target. 

6.2.3  Laser  Tracking  System  Performance  Requirements 

The  performance  requirements  for  a  laser  tracking  system  are 
almost  identical  to  those  for  a  radar  tracking  system  with  the  difference 
that  an  optical  system  is  utilized  instead  of  an  antenna. 

6.2.4  Video  Tracking  System  Performance  Requirements 

The  critical  parameters  in  a  video  tracking  system  are:  the 
optical  alignment  of  the  camera  to  the  vehicle  axis;  the  field  of  view 
of  the  lens  system;  and  the  sensitivity  of  the  camera,  which  determines 
its  ability  to  provide  a  usable  video  image  to  the  operator  at  extreme 
range  and  under  various  light  conditions.  The  depth-of-field  and/or 
focus  of  the  lens  system  must  be  adequate  to  provide  a  clear  image  of 
the  target  area. 

6.2.5  Infrared  Guidance  and  Control  System  Performance  Requirements 

The  range  and  accuracy  of  an  infrared  guidance  and  control 
system  is  largely  determined  by  its  sensor  array.  The  sensitivity  of 
the  infrared  detectors  must  be  great  enough  to  detect  the  target 
radiation  at  sufficient  range  to  allow  missile  maneuvering,  yet  not  great 
enough  to  lock  onto  erroneous  sources.  Where  multiple  detectors  are 
utilized,  the  sensitivity  of  each  should  be  balanced  to  the  extent  that 
a  target  directly  ahead  will  provide  equal  outputs  from  all  detectors. 

The  field-of-view  of  the  sensor  array  should  be  narrow  enough  to  exclude 
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general  background  radiation  and  enable  lock-on  to  an  individual  target 
and  wide  enough  to  allow  detection  of  the  target  within  a  reasonable 
pointing  angle  from  the  missile  flight  path. 

6.3  ENVIRONMENTAL  REQUIREMENTS 

Since  guidance  and  control  systems  are  partially  or  wholly 
contained  in  the  missile  airframe,  their  design  considerations  must 
include  the  missile  environment.  This  environment  includes  shock  and 
vibration,  acceleration,  temperature  and  moisture  extremes,  and  barometric 
pressure  variations.  Size  and  weight  of  the  system,  in  as  much  as  they 
affect  the  range,  and  aerodynamics  of  the  missile  are  another  consideration. 

6.4  BIT  CONSIDERATIONS 

The  primary  objective  of  designing  built-in  test  capabilities 
into  guidance  and  control  systems  is  to  increase  the  probability  that 
the  weapon  system  will  be  delivered  to  a  point  within  lethal  range  of  the 
target.  This  goal  is  reached  by  determining  the  status  of  all  functional 
elements  in  the  guidance  and  control  system  so  that  corrective  action 
can  be  taken  in  the  event  of  system  degradation  or  component  failures. 

Additional  benefits  obtained  from  the  inclusion  of  BIT  are: 

o  Reduction  in  the  MTTR  of  the  system  through  improved 
fault  isolation. 

o  Reduction  in  skill  levels  of  maintenance  personnel. 

6.4.1  BTT  Coverage 

In  many  guidance  and  control  systems,  a  failure  during  testing 
necessitates  changeout  of  major  assemblies  or  the  expenditure  of  consider¬ 
able  man-hours  to  isolate  the  malfunction  to  the  modular  level.  This  is 
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required  because  the  level  of  external  instrumentation  is  not  adequate 
to  isolate  the  failure  to  a  specific  module  within  the  system.  This 
practice  results  in  a  costly  spares  inventory  and/or  excessive  system 
downtime.  With  proper  utilization  of  BIT  capabilities,  failure  isolation 
to  modular  levels  can  be  achieved. 

For  the  typical  inertial  guidance  and  control  system  depicted 
in  Figure  5,  the  three  gyros,  azimuth  resolver,  accelerometers,  drive 
motors,  and  angle  readouts  are  all  contaii.-J  within  the  platform 
structure.  The  servo  amplifiers  are  mounted  in  a  second  assembly,  and 
the  computer  is  the  third  major  component.  With  proper  instrumentation, 
such  as  at  points  1  through  11,  and  selective  stimuli  applied  to  each 
platform  axis,  a  failure  can  be  isolated  to  a  single  one  of  these 
components.  For  example:  a  defective  "X"  gyro,  when  torqued,  will  give 
erroneous  signals  at  points  1  and  2  when  the  platform  azimuth  axis  is 
at  zero  degrees,  and  will  give  erroneous  signals  at  points  1  and  6  for 
a  platform  azimuth  of  90  degrees. 

For  each  individual  guidance  and  control  system,  the  extent  of 
BIT  coverage  is  determined  by  failure  mode  analyses,  the  weapon  system 
maintenance  plan,  and  related  cost  considerations. 

6.4.2  Self-Test 

Testing  of  BIT  circuitry  can  be  performed  in  several  ways. 

In  systems  that  contain  digital  computers,  the  computer  can  be  utilized 
to  perform  all  off-line  system  testing,  including  self-check  of  BIT 
circuitry  with  minimal  operator  intervention.  A  typical  test  sequence 
for  this  type  of  system  would  be  as  follows: 

o  A  computer  self- test  program  consisting  of  memory  tests, 
arithmetic  logic  tests,  and  control  logic  tests. 
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o  A  computer- control  led  check  of  analog  and  digital 

interface  circuitry  with  computer  outputs  tied  back  to 
computer  inputs.  This  test  would  also  provide  indica¬ 
tions  to  an  operator  to  check  output  interface  circuitry. 

i 

o  Computer-controlled  testing  of  the  entire  guidance  and 
control  system.  This  series  of  tests  would  constitute 
the  prelaunch  test  sequence. 

6.4.3  Fail  Safe 

BIT  circuitry  must  be  designed  to  be  as  fail  safe  as  practical. 
The  reliability,  as  measured  by  MTBF,  should  approach  an  order  of 
magnitude  greater  than  the  remainder  of  the  system  hardware.  In  addition, 
the  circuit  design  should  be  configured  to  enhance  the  operational 
reliability.  For  example,  digital  inputs  to  BIT  should  be  configured 
such  that  an  active  or  high  state  represents  the  normal  operating  state, 
with  a  zero  or  low  state  denoting  a  failure.  In  this  manner,  poor 
connections,  open  circuity,  and  ground  faults  are  readily  detected.  Re¬ 
dundant  or  voting  logic  type  of  circuits  can  be  utilized  in  critical 
areas  where  high  reliability  is  a  requirement. 

6.4.4  Prelaunch  Testing 

Prelaunch  testing  of  guidance  and  control  systems  consists  of 
exercising  all  operational  modes  of  the  system  and  verifying  proper 
responses  to  test  stimuli.  The  type  of  tests  will  vary  according  to  the 
type  of  system. 

For  a  typical  inertial  guidance  and  control  system,  the  test 
scenario  follows  a  basic  building  block  of  integration  and  calibration 
testing: 
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o  Verification  of  Platform  Control  Circuitry 

Platform  servo  locos  are  tested  in  both  caged  and 
stabilized  modes  of  operation.  A  gross  check  of  gryo 
torquing  circuits  is  performed,  and  the  platform  angle 
readout  devices  are  tested  for  proper  output. 

o  Instrument  Calibration 

Using  known  input  stimuli  (earth  rotation  rates  and 
gravitational  attraction),  gyro  torquing  scale  factors 
and  drift  compensation,  and  accelerometer  scale  factors 
and  biases  are  established  and/or  adjusted. 

o  Operational  Tests 

The  system  is  exercised  through  a  sequence  of  pseudo- 
operational  sequences  while  monitoring  platform  angular 
errors  and  computed  position.  During  the  level  alignment 
mode,  the  platform  is  torqued  by  the  accelerometers  to 
achieve  zero  gravity  on  the  level  axis  instruments,  and 
the  level  axis  deviations  are  measured.  In  the  azimuth 
alignment  mode,  earth  rate  torquing  for  a  specified 
heading  is  applied  to  the  gyros,  the  platform  is  placed 
in  a  gyro-compassing  mode,  and  the  final  azimuth  and 
level  axis  errors  are  measured  and  tested  to  be  within 
design  specifications.  In  the  free-flight  mode,  the  system 
operates  in  its  normal  post-launch  mode,  and  platform 
angle  errors  and  computed  position  are  measured  and  tested 
to  be  within  the  specified  limits. 

For  an  infrared  tracking  system,  prelaunch  tests  would  include 
checks  of  the  infrared  detector  sensitivity  and  the  directivity  of  the 
sensor  head.  These  tests  require  a  infrared  source  as  a  test  stimulus. 
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This  source  must  be  controlled  in  both  the  magnitude  of  radiation  and  its 
relative  location  with  respect  to  the  missile. 

Prelaunch  testing  of  laser  or  radar  tracking  systems  would 
include  measurement  of  the  transmitter  power  and  beam  width  as  well  as 
the  directivity  and  sensitivity  of  the  receiver  sensors  and/or  antenna. 

In  addition,  a  check  of  the  range  determination  circuitry  should  be 
performed  using  a  delay  circuit  to  synthesize  a  receiver  input  signal. 

6.4.5  Post  Launch  Testing 

Post  launch  testing  of  guidance  and  control  systems  is 
basically  a  monitor- type  of  checking  to  detect  catastrophic  failures 
which  could  seriously  impair  the  weapon  system  effectivity.  For  example, 
in  an  inertial  guidance  and  control  system  the  loss  of  gyro  spin  motor 
excitation  would  result  in  a  loss  of  stable  platform  reference  and 
erroneous  accelerometer  outputs,  causing  the  weapon  to  veer  drastically 
from  the  desired  flight  path.  By  monitoring  the  excitation  and/or 
accelerometer  signals,  the  failure  would  be  detected  and  appropriate 
corrective  action,  such  as  reducing  the  steering  signals  to  null  and 
aborting  any  fuze  signal  based  upon  a  possible  erroneous  range  calculation, 
could  be  effected. 
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SECTION  7.0 
POWER  SYSTEMS 


7.1  DESIGN  OBJECTIVES 

The  power  supply  sections  of  weapons  systems  should  be  designed 
with  a  built-in-test  (BIT)  capability  to  provide  an  increased  assurance 
of  operational  readiness  at  all  times.  By  including  BIT,  the  mean-time- 
to-repair  (MTTR)  is  reduced,  thus  providing  an  increase  in  system  avail¬ 
ability.  Out-of- tolerance  conditions  and  failures  in  other  parts  of 
weapons  systems  due  to  incorrect  supply  voltages  will  be  reduced  with  a 
consequent  improvement  in  reliability. 

7.2  SYSTEM  OPERATION 

Power  systems  can  be  divided  into  three  sections:  power  sources, 
power  converters,  and  power  regulators.  Table  1  lists  some  of  the  more 
common  types  in  each  division.  Some  power  systems  may  not  require  all 
three  sections;  whereas,  other  systems  may  use  multiple  combinations  of 
the  three.  Figure  7  shows  a  block  diagram  of  a  typical  power  system  for 
a  small  missile.  If  the  missile  had  a  built-in  guidance  system  it  would 
probably  also  require  400  Hz  ac,  and  the  power  system  would  include  a 
module  for  converting  dc  to  ac.  Some  missiles  derive  their  internal  power 
from  an  Auxiliary  Power  Unit  (APU)  which  usually  operates  on  high  pressure 
gas  stored  in  the  missile.  An  APU  output  of  400  Hz  ac  can  directly  power 
the  guidance  system  and  can  be  converted  to  the  proper  dc  levels  for 
operating  other  electrical  systems. 

To  reduce  the  storage  requirements  in  missile,  external  power  is 
utilized  during  standby  and  part  of  checkout.  The  system  is  then  switched 
to  internal  power  for  the  last  part  of  checkout  and  launch.  The  operation 
of  the  power  system  on  both  external  and  internal  power  should  be  verified 
with  BIT  circuitry.  The  BIT  monitors  can  ensure  that  internal  power  is 
functioning  properly  before  the  system  is  switched  from  external. 
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Table  1.  Power  System  Divisions 


Power  Sources 

Power 

Converters 

Power  Regulators 

Batteries 

DC 

to 

DC 

Linear 

DC 

to 

AC 

Switching 

Auxiliary  Power 

Uni  ts 

AC 

to 

DC 

AC 

AC 

to 

AC 

Motor-Generator 

_ 

Sets 

A  motor-generator  set  is  normally  used  to  provide  ac  power  for  a 
fire  control  unit.  The  power  is  routed  to  the  various  sections  of  the 
fire  control  unit  where  converters  and  regulators  provide  the  particular 
voltages  required  by  individual  pieces  of  equipment.  In  cases  where 
several  items  use  a  specific  voltage  such  as  28  Vdc,  one  regulator  will 
operate  a  bus,  and  the  power  will  be  routed  as  required.  Decoupling  filters 
are  then  used  at  each  load  to  prevent  undesirable  interactions  between  units 
The  fire  control  unit  power  system  should  contain  sufficient  BIT  circuitry 
to  continuously  define  the  operational  status  and  pin-point  any  failures 
to  specific  locations. 

7.3  SPECIAL  CONSIDERATIONS 

Since  a  power  system  feeds  power  to  all  areas  of  a  weapons  system, 
it  is  important  to  maintain  continuous  monitoring  on  all  outputs.  The 
proper  operation  of  a  weapons  system  is  dependent  on  all  voltages  being 
correct.  Some  equipment  also  requires  the  application  of  voltages  in  a 
particular  sequence  and  sometimes  with  time  delays.  For  instance,  a  power 
amplifier  tube  in  a  transmitter  requires  up  to  2  minutes  between  application 
of  filament  and  plate  voltages  to  allow  the  cathode  to  reach  operating 
temperature.  8oth  voltages  can  safely  be  removed  at  the  same  time.  A 
computer  requires  that  its  basic  voltage,  usually  5  volts,  be  applied  prior 
to  all  other  voltages  and  removed  after  the  others.  These  special  time 


sequence  funtions  performed  by  the  power  system  should  be  verified  by 
BIT  monitors.  The  BIT  circuitry  can  be  programmed  to  inhibit  improper 
sequences  or  time  delays. 

When  a  failure  occurs  in  a  power  system  output,  the  voltage  may 
go  high  and  produce  catastrophic  results  in  any  equipment  connected  to 
that  output.  Crowbar  circuits  are  sometimes  used  to  detect  such  an  over¬ 
voltage  condition  and  short  the  output.  This  will  cause  a  fuse  or 
circuit  breaker  to  open  and  protect  the  loads  from  the  overvoltage.  If 
it  is  desired  to  test  a  crowbar  circuit,  it  must  be  disconnected  from 
the  power  supply  and  stimulated  with  the  required  voltage  to  verify  trip 
action.  The  trip  voltage  should  be  removed  and  a  lower  voltage  applied 
to  verify  that  it  does  not  trip  below  the  required  point.  After  success¬ 
fully  completing  these  two  tests,  it  would  be  reconnected  to  the  power 
circuit.  A  BIT  circuit  would  need  to  be  specially  designed  for  the  crowbar 
test  and  would  only  be  actuated  on  manual  or  computer  command. 

A  BIT  monitor  normally  operates  from  the  power  utilized  by  the 
other  circuits  in  an  area.  However,  the  BIT  circuits  monitoring  power 
systems  need  a  separate  or  redundant  source  of  power  so  that  a  single 
voltage  failure  will  not  render  the  BIT  circuit  inoperative.  This  is 
especially  important  if  automatic  switchover  to  backup  modules  is  anti¬ 
cipated. 

7.4  PERFORMANCE  SPECIFICATIONS 

Specifications  for  power  system  outputs  and  input  power  require¬ 
ments  for  all  other  systems  must  be  evaluated  to  determine  realistic 
settings  for  the  BIT  monitors.  When  several  modules  operate  from  a  power 
bus,  their  input  requirements  will  probably  be  somewhat  different.  The 
most  critical  of  the  input  requirements  must  be  used  for  determining  the 
BIT  monitor  settings. 
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BIT  circuitry  should  be  used  to  monitor  intermediate  points 
within  power  systems.  For  example,  in  Figure  7  monitoring  the  input  and 
output  to  each  of  the  three  voltage  regulators  would  provide  information 
for  isolating  a  failure  to  the  converter  or  a  regulator.  Acceptable 
performance  specifications  must  be  established  for  all  these  intermediate 
points  so  that  limits  for  the  BIT  monitors  can  be  determined. 

7.5  BIT  CONSIDERATIONS 

Many  factors  must  be  considered  when  implementing  BIT  into  a 
power  system.  The  goal  is  to  improve  the  reliability  of  the  weapon 
system;  therefore,  BIT  circuitry  must  be  reliable  itself.  BIT  design 
should  be  oriented  for  fail-safe  operation  so  that  any  failures  in  BIT 
circuits  or  interconnecting  cables  will  result  in  a  failure  indication. 

BIT  monitors  should  also  include  provisions  for  self-testing  so  that 
proper  operation  can  be  verified  whenever  necessary. 

The  extent  of  BIT  coverage  must  be  established.  It  will  normally 
extend  down  to  the  smallest  element  that  is  plug-in  replaceable.  However, 
additional  test  points  may  be  specified  in  plug-in  elements  to  improve 
their  testability  during  higher  echelon  maintenance.  The  amount  of  BIT 
coverage  should  be  determined  through  coordination  of  the  failure  mode 
analysis,  the  logistic  support  analysis,  the  weapons  system  maintenance 
plan,  and  interrelated  cost  considerations. 

7.6  SPECIFIC  EQUIPMENT  APPROACHES 

Power  systems  will  require  a  diverse  series  of  measurements  to 
completely  define  their  operating  characteristics.  Predominant  among 
these  is  the  determination  that  voltage  levels  fall  within  prescribed  upper 
and  lower  limits.  This  measurement  will  be  required  at  numerous  points 
in  a  power  system  and  can  utilize  a  standard  sensor  that  can  be  programmed 
for  voltage  level  and  polarity.  Test  point  locations  and  types  of  measure¬ 
ments  for  the  different  elements  that  comprise  a  variety  of  power  systems 
are  examined  in  the  following  paragraphs. 
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7.6.1 


Power  Sources 


Three  general  types  of  power  sources  coinnonly  used  in  weapons 
systems  are  batteries,  auxiliary  power  units,  and  motor-generator  sets 
(see  Table  1).  Each  type  operates  differently  and  therefore  presents 
unique  monitoring  requirements. 

7. 6. 1.1  Batteries  -  Batteries  are  normally  used  where  a  limited  amount 
of  power  is  required  and  other  sources  are  not  conveniently  available. 

They  can  provide  power  at  a  low  rate  for  a  lor.g  time  or  at  a  high  rate  for 
a  short  time.  All  batteries  have  internal  leakage  current  which  gradually 
reduces  the  stored  energy  at  a  rate  dependent  on  the  internal  construction 
of  the  battery  and  the  storage  temperature.  The  charge  state  of  a  battery 
should  be  monitored  to  ensure  that  adequate  energy  is  left  to  accomplish 
its  required  task.  The  BIT  circuitry  used  will  vary  depending  on  the  type  of 
battery  and  its  intended  use.  There  are  many  different  batteries  with 
varying  characteristics,  but  they  can  be  grouped  into  two  major  cate¬ 
gories  which  are: 

o  Prime  -  must  be  replaced  when  discharged 

o  Secondary  -  can  be  recharged  when  necessary 

Both  types  of  batteries  should  have  a  sensor  to  monitor  the 
terminal  voltage.  This  is  a  reasonable  measure  of  the  charge  state  on 
most  batteries,  especially  if  done  under  load.  Some  batteries,  nickle- 
cadmium  is  a  good  example,  have  such  a  flat  discharge  curve  that  is  is 
difficult  to  determine  the  charge  state  from  the  terminal  voltage.  On 
these  the  voltage  measurement  does  reveal  if  the  battery  is  completely 
discharged,  if  one  or  more  of  the  cells  are  shorted,  or  if  the  internal 
resistance  has  increased  so  the  battery  will  no  longer  handle  the  required 
load. 
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Prime  batteries  in  weapons  systems  are  normally  replaced  at 
scheduled  intervals  to  ensure  that  workable  batteries  will  be  in  place 
when  needed.  If  BIT  sensors  are  used  to  monitor  the  status  of  these 
batteries,  the  confidence  level  will  be  increased  since  early  failures 
can  be  detected.  The  BIT  circuitry  should  not  obtain  its  operating  power 
from  these  batteries  but  from  an  external  source  such  as  the  power  that 
operates  the  missile  circuitry  during  testing. 

When  secondary  batteries  are  used  to  power  a  system,  operational 
testing  can  be  performed,  and  the  batteries  can  then  be  recharged  to  full 
capacity  to  be  ready  for  future  use.  When  long-term  storage  is  required, 
periodic  charging  or  trickle  charging  is  used  to  maintain  full  capacity. 

The  terminal  voltages  of  these  batteries  will  vary  over  a  wide  range 
between  the  no-load  charging  situation  and  the  full-load  discharging 
situation.  Sensors  for  two  low  voltage  thresholds  and  one  high  voltage 
threshold  are  needed  to  provide  adequate  monitoring  of  their  condition. 

One  low  threshold  should  be  the  minimum  allowable  voltage  under  load  with 
no  input  from  a  charger.  The  other  low  threshold  should  be  the  minimum 
acceptable  voltage  reached  during  charging,  and  the  high  threshold  should 
be  the  maximum  acceptable  voltage  reached  during  charging.  The  output  from 
the  sensor  monitoring  the  minimum  voltage  attained  during  charging  will 
indicate  a  failure  except  for  the  latter  portion  of  the  charge  cycle. 
Consequently,  this  indication  should  either  be  part  of  a  manual  test  or 
should  be  qualified  for  only  the  appropriate  time  periods. 

7. 6. 1.2  Auxiliary  Power  Units  -  An  Auxiliary  Power  Unit  (APU)  should  have 
BIT  monitors  on  all  outputs  to  check  for  low  voltage  and  high  voltage,  and 
when  appropriate,  for  frequency  accuracy.  Since  an  APU  will  be  operated 
only  during  a  launch  sequency  or  for  testing,  the  output  monitors  can  be 
activated  for  only  those  time  periods.  However,  if  the  missile  is  also 
tested  using  external  power  in  place  of  the  APU,  the  BIT  sensors  can  also 
be  used  to  monitor  the  external  power.  This  will  require  the  sensors  to 


be  connected  beyond  any  devices  used  to  switch  between  power  sources. 

If  it  is  also  desired  to  monitor  the  APU  output  before  transferring 
from  external  power,  then  a  switching  arrangement  will  be  required  for 
the  sensors,  or  separate  sensors  must  be  used. 

Most  APU's  derive  their  power  from  compressed  gas  which  is 
stored  in  a  high  pressure  container  until  needed.  The  pressure  in  this 
container  must  be  regularly  checked  to  ensure  that  an  adequate  supply 
of  gas  is  available.  A  BIT  sensor  can  be  used  to  continuously  monitor 
this  pressure  and  provide  a  status  output  to  a  central  location.  Trans¬ 
ducers  are  available  that  produce  an  analog  output  relative  to  input 
pressure  or  that  switch  levels  digitally  at  preset  values  of  pressure. 

7. 6. 1.3  Motor-Generator  Sets  -  Fire  control  units  normally  receive  their 
operating  power  from  Motor-Generator  (MG)  sets.  When  possible,  energy 
from  local  power  grids  is  utilized,  but  MG  sets  are  maintained  for  backup 

in  case  of  local  power  failure  and  become  the  prime  source  during  emergency 

conditions.  This  input  power  to  fire  control  units  will  be  converted  to 
the  various  levels  required  to  operate  the  different  systems,  but  should 
be  monitored  at  the  input  to  verify  that  it  stays  within  proper  limits. 

An  MG  set  consists  of  a  generator  coupled  to  the  output  shaft 
of  typically  a  diesel  engine.  The  engine  is  operated  at  a  relatively 
constant  speed  so  the  generator  output  frequency  will  be  within  tolerance. 
There  are  several  parameters  relative  to  proper  operation  of  the  engine 
that  should  be  monitored. 

o  The  amount  of  fuel  remaining 

o  The  engine  coolant  temperature 
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o  The  battery  voltage 


o  The  lubricating  oil  pressure 

When  commercial  power  is  being  used  and  the  MG  set  is  not  in 
operation,  the  fuel  remaining  and  the  battery  voltage  should  continue  to 
be  checked  to  assure  system  readiness  at  all  times.  The  BIT  sensor 
monitoring  oil  pressure  would  need  to  be  inhibited  with  the  engine  not 
operating  to  prevent  a  false  failure  indication. 

7.6.2  Power  Converters 

Power  converters  are  used  to  change  input  power  to  the  ac  and 
dc  voltage  levels  required  for  operating  the  different  sections  of  weapons 
systems.  They  also  convert  60  Hz  or  dc  power  to  400  Hz  when  this  frequency 
is  needed.  The  outputs  from  power  converters  can  be  used  directly  or 
can  be  routed  through  regulators  when  closer  tolerances  are  required. 

Four  basic  types  of  power  converters  are  listed  in  Table  1. 

The  two  converters  used  to  provide  ac  power  will  normally  use 
switching  techniques  to  maintain  high  efficiency.  The  frequency  of  the 
output  power  is  held  to  any  necessary  tolerance  range  by  use  of  the  proper 
internal  control  elements.  However,  the  frequency  should  still  be 
monitored  by  a  BIT  sensor  to  verify  that  it  is  within  the  desired  limits. 
The  amplitude  of  the  output  ac  is  regulated  in  some  converters.  In  others, 
the  output  is  directly  proportional  to  the  input  voltage  with  additional 
variations  produced  by  load  changes.  For  these  units  any  regulation  must 
be  accomplished  external  to  the  converters. 

All  converter  outputs  should  be  monitored  with  BIT  circuitry 
except  where  a  converter  and  a  regulator  are  combined  on  a  single  PC  card. 
In  that  case,  the  converter  output  should  be  brought  to  a  test  point  to 
improve  the  testability  of  the  PC  card  in  the  event  of  failure. 
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7.6.3  Power  Regulators 


Regulators  are  used  to  reduce,  to  acceptable  limits,  the 
variations  in  power  provided  to  equipment.  Voltages  direct  from  power 
sources  can  vary  over  a  relatively  wide  range  just  due  to  the  normal 
operating  characteristics  of  the  sources.  For  example,  the  output  voltage 
from  a  battery  can  decrease  by  as  much  as  15  percent  as  its  energy  is 
depleted.  Additional  variations  will  be  produced  by  changes  in  the  load. 
Some  power  converters  include  regulation  against  input  variations  and 
sometimes  against  load  changes  on  one  output.  If  multiple  outputs  need 
regulation  or  if  tighter  specifications  are  necessary,  the  separate 
regulators  must  be  used. 

There  are  two  types  of  regulators  generally  used  for  dc  voltages  - 
linear  and  switching.  Linear  regulators  provide  the  best  regulation, 
least  ripple,  and  quickest  response  to  load  changes  while  switching 
regulators  produce  the  highest  efficiency  with  the  smallest  and  lightest 
package.  The  choice  of  which  one  is  used  is  based  on  specific  require¬ 
ments  for  a  particular  power  system  and  can  be  a  combination  of  the  two. 

Both  regulator  types  should  have  8IT  monitors  on  their  inputs  and  outputs. 
When  more  than  one  regulator  is  operated  from  the  same  power  converter 
output,  it  is  not  necessary  to  duplicate  the  monitors.  A  single  BIT  sensor 
can  monitor  several  regulator  inputs  and  the  power  converter  output  common 
to  them.  To  prevent  duplication,  yet  provide  complete  converage,  BIT 
monitors  should  be  specified  for  power  converter  and  power  source  outputs 
rather  than  regulator  inputs. 

If  overvoltage  crowbars  are  used  in  the  power  system,  they  should 
be  on  the  outputs  of  the  regulators.  This  does  not  obviate  the  need  for 
BIT  sensors  on  the  outputs.  The  crowbars  will  provide  protection  against 
catastrophic  failures;  whereas,  the  BIT  sensors  will  detect  long-term 
voltage  changes,  either  high  or  low,  due  to  circuit  drift.  The  BIT  sensor 
high  threshoM  level  should  therefore  be  set  below  the  crowbar  trigger  level. 


Regulators  are  sometimes  used  on  60  Hz  ac  power  to  reduce  the 
voltage  variations.  These  regulators  normally  utilize  magnetic  principles 
and  consequently  are  heavy  and  bulky.  They  are  very  reliable  but  their 
output  should  still  be  monitored  with  a  BIT  sensor. 

Regulation  of  400  Hz  ac  power  is  usually  accomplished  at  the 
power  converter  when  needed.  If  the  converter  itself  does  not  regulate 
its  output  voltage,  this  function  can  be  performed  by  regulating  the 
input  to  the  converter.  In  effect,  a  dc  regulator  ahead  of  the  converter 
would  be  controlled  by  the  ac  out  of  the  converter  to  maintain  the  proper 
ac  voltage.  This  same  type  regulation  can  be  used  for  ac  to  ac  power 
converters  also,  since  they  convert  input  ac  to  dc  then  convert  this  dc  to 
the  output  ac.  A  BIT  sensor  should  monitor  the  dc  level  from  the  regulator 
output  to  the  converter  input. 
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SECTION  8.0 

BASIC  BIT/BITE  DESIGN  OUTLINE 


8.1  INTRODUCTION 

The  outline  contained  in  this  section  summarizes  the  steps 
required  for  the  cost  effective  inclusion  of  BIT/BITE  in  the  development 
of  Army  Missile  Systems.  The  design  procedures  are  applicable  to 
mechanical/electrical  systems  and  subsystems  down  to  a  level  of  detail 
dependent  on  available  data  and  the  stage  of  system  design.  A  prime 
requirement  for  the  cost  effective  application  of  BIT/BITE  is  that  the 
following  design  procedures  be  incorporated  early  in  the  system  design. 
Redesign  of  completed  designs  is  a  costly  method  of  implementing  BIT/BITE. 

BIT  systems  have  been  functionally  used  as  go/no-go  devices  for 
many  years  on  mechanical,  electrical,  and  chemical  systems.  However, 
they  were  called  alarms.  Life-cycle  costing  has  emphasized  the  high  cost 
of  maintenance  in  terms  of  fault  location  and  isolation  times  as  well  as 
the  maintenance  skill  level  required  to  service  modern  weapons.  Reduction 
of  this  cost  has  led  to  the  requirement  that  BIT  not  only  provide  go/no-go 
signals,  but  that  fault  isolation  and  fault  location  times  be  reduced. 

This  reduction  in  maintenance  time  is  accomplished  by  including,  in  the 
hardware  design,  test  points,  sensors,  and  indicators  to  adequately  monitor 
the  significant  equipment  faults  that  can  occur. 

o  Adequate  Monitoring 

Locate  and  isolate  the  fault  to  the  rep  aceable  hardware 
as  determined  by  the  level  of  maintenance  being  performed. 

o  Significant  Faults 

Those  faults  with  the  best  chance  of  occurring  and  which  na^e 
the  largest  fault  isolation  and  location  times. 


The  above  requires  that  BIT  equipment  be  designed  to  accomplish  the  work 
of  a  highly  trained  technician,  thus  reducing  the  maintenance  skill  level 
requirements.  BIT  system  design  to  accomplish  the  above  consists  of: 

o  Quantitatively  specifying  BIT  as  required  by  system 
availability  as  shown  in  paragraph  8.2. 

o  Evaluating  candidate  BIT  systems  based  on  the  system  block 
diagram  used  for  FMEA  as  shown  in  paragraph  8.3,  and 
determining  that  the  BIT  detectability  level  specification 
has  been  met. 

8.2  BIT  DETECTABILITY  LEVEL  SPECIFICATION 

The  performance  specifications  for  BIT  are  discussed  in  Section 
3.0,  paragraph  3.8,  of  this  Design  Guide.  The  BIT  level  of  detectability 
(k)  is  of  prime  importance  and  is  governed  by  the  system  availability 
requirement  as  defined  in  Equation  (1).  Detectability  is  determined  by 
first  computing  the  joint  detectability/maintainability  probability 
kM(tr)  from  which  k  is  set  to  determine  maintainability.  Equation  (3).  The 
mean-time- to-repair  (M^y )  is  then  assessed.  Equation  (4).  The  details  of 
these  steps  are  as  follows: 

Availability  (operational  readiness)  of  the  system  as  time  (ta)  is 
A(tr)  =  R(tm)  +  [kM(tr)][l  -  R(tm)],  (1) 

where 

R(tm)  =  Probability  that  the  system  will  survive  the  specified 

mission  of  duration  t  without  failure, 

m 

t  =  Specified  turnaround  time,  or  maximum  downtime  for  repair 
of  system, 
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k  =  Probability  that  if  a  system  failure  occurs  it  will 
be  detected  during  system  checkout,  and 

M(tr)  =  Probability  that  a  detected  system  failure  can  be 
repaired  in  time,  tr,  to  restore  the  system  to 
operational  status. 

System  analysis  determines  mission  reliability  R(tm),  mission 
availability  A(tr),  and  kM(tp)  is  determined  from  Equation  (1)  as: 

A(t  )  -  R(t  ) 

kH(tr>  -  -  rhtf  <2> 

m 

kM(tr)  is  the  joint  probability,  given  that  a  system  failure  has 

occurred,  that  the  failure  will  be  detected  and  repaired  within  turnaround 

time  t  . 
r 


BIT  detectability  level  (k)  is  set  by  system  analysis  to  determine 
the  maintainability  requirement  as: 


M(tr)  = 


kM(tr) 

k 


(3) 


Equation  (3)  means  that  M( t^ )  percent  of  all  system  repair  actions  must 
be  completed  within  the  specified  turnaround  time  (tr). 

The  mean-time- to-repair  (Mqj)  is  computed  from  the  maintainability 
requirement  as: 


MCT  =  Inll-Mfyj 


(4) 
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8.3  BIT  SYSTEM  DESIGNS 

Candidate  BIT  systems  for  design  are  derived  in  a  cost-effective 
manner  by  locating  integral  sensors  at  proper  test  points  for  performance 
monitoring  and  fault  isolation.  The  test  point  selection  is  based  on 
probability  of  failure  data  for  each  functional  area  so  that  the  measure¬ 
ments  are  biased  in  the  areas  most  likely  to  fail.  Naturally  sensor 
feasibility  and  cost  must  also  be  taken  into  consideration  for  a  cost- 
effective  BIT  design.  The  following  paragraphs  illustrate  a  straight¬ 
forward  method  of  test  point  (sensor)  selection  based  on  the  system  functional 
block  diagram  (Figure  8)  used  in  the  FMEA.  The  design  consists  of  the 
following: 

o  Initially,  test  points  (sensors)  are  located  on  all  inputs 
and  outputs  of  the  functional  areas  of  the  system  block 
diagram. 

o  A  fault  code  matrix  is  made  for  the  sensors. 

o  Various  sensor  sets  are  evaluated  using  the  fault  code  and 
failure  data. 

o  Finally,  the  BIT  detectability  level  is  computed  and  evaluated 
to  meet  the  specifications. 

8.3.1  Base  Test  Point  (Sensor)  Location 

A  general  system  block  diagram  showing  inputs  and  outputs  from 
each  functional  area  is  depicted  in  Figure  8.  The  functional  areas  repre¬ 
sent  electrical  and/or  mechanical  subsystems  and  correspond  to  Line 
Replaceable  Units  (LRU's)  as  defined  by  the  level  of  maintenance.  Sensors 
are  shown  at  each  input  and  output.  It  should  be  noted  that  this  is  the 
ultimate  in  sensor  requirements  and  maximizes  the  cost  of  sensors.  The 
object  of  the  following  fault  code  establishment  and  sensor  set  evaluation 
is  to  reduce  the  number  of  sensors  required  to  design  a  cost-effective  BIT 
system. 

i 
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8.3.2  Fault  Code  Matrix 


Based  on  the  system  block  diagram,  a  fault  code  is  established. 

The  fault  code  is  a  matrix  tabulating  the  functional  area  failed  versus 
sensor  number  sensing  a  fault  coded  as  0  or  sensing  a  no-fault  coded  as 
a  1.  The  fault  code  as  derived  from  Figure  8  would  be  as  shown  in  Table  2. 

Table  2.  Fault  Code  Matrix 
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Sensor  No. 
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The  above  fault  code  is  simplified  by  assuming  that  all  sensors 
downstream  of  a  fault  indicate  that  a  fault  has  occurred.  This  is  not 
necessarily  true,  but  the  sensor  immediately  following  the  failed  LRU  must 
indicate  a  fault  for  correct  BIT  fault  isolation. 

The  fault  code  is  evaluated  for  redundant  sensors  and  the  degree  of 
functional  area  isolation.  Columns  7,  8,  and  9  of  Table  2  are  identical, 
thus  two  of  the  sensors  are  redundant.  Also,  identical  columns  2  and  3 
indicate  that  one  of  these  sensors  may  be  redundant.  Redundant  sensors  can 
be  eliminated  if  the  outputs  they  are  monitoring  are  100  percent  dependent; 
i.e. ,  sensors  7  and  8  are  monitoring  a  cotmiand  output  of  functional  area 
number  6,  and  if  both  sensors  fail  when  this  functional  area  fails,  the 
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outputs  are  100  percent  dependent.  Sensors  2  and  3  are  monitoring  outputs 
of  FA2.  Both  sensors  will  only  fail  if  there  is  a  failure  in  components 
conmon  to  the  two  channels.  Also  similar  rows  in  the  fault  code  matrix  show 
that  the  sensors  cannot  discriminate  between  faults  in  these  functional 
areas;  i.e.,  failures  in  functional  areas  6  and  7  cannot  be  localized  in  the 
fault  code  by  sensors  only.  It  is  necessary  to  replace  one  unit,  either 
6  or  7,  and  repeat  the  test  to  isolate  the  failure. 

Having  eliminated  the  redundant  sensors,  engineering  judgement  must 
be  used  in  terms  of  failure  probabilities  to  assure  that: 

o  Sensors  isolating  frequent  faults  are  most  desirable. 

o  Unique  fault  code  patterns  and  minimum  number  of  substitutions 
are  most  desirable. 

The  probability  of  a  given  LRU  failure  can  be  found  from: 

P  =  1  -  e'AT,  (5) 

where 

P  is  the  probability  of  failure, 

\  is  the  failure  rate  per  10®  hours,  and 

T  is  the  mission  time. 

8.3.3  BIT  System  Evaluation 

The  ultimate  BIT  system,  as  shown  in  Figure  8,  measures  all  inputs/ 
outputs,  and  isolates  tn  the  lowest  possible  level.  LRU  and  sensor  evaluation 
data  is  used  in  a  straightforward  manner  to  'ninimize  the  number  of  sensors 
required  to  meet  the  BIT  detectability  specifications.  Tables  3  and  4,  using 
the  general  system  block  diagram  shown  in  Figure  8,  illustrate  a  method  of 
tabulating  the  LRU  and  sensor  data  required  for  analysis.  This  data  and  the 
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fault  code  matrix  (Table  2)  are  the  data  base  from  which  various  sensor 
sets  can  be  formed  for  evaluation.  The  process  of  evaluation  to  designate 
the  use  or  elimination  of  various  sensors  is  illustrated  by  the  following: 

o  Redundant  sensors  are  eliminated  by  noting  duplicate  columns 
in  the  fault  code  matrix  (Table  2)  while  taking  into  con¬ 
sideration  the  dependency  relationship  tabulated  in  column  5 
of  Table  3. 

o  LRU  isolation  possibilities  are  found  by  noting  duplicate 
rows  in  the  fault  code  matrix  (Table  2). 

o  LRU  candidates  are  found  by  evaluating  columns  4,  6,  7,  and 
8  (Table  3).  Those  with  the  largest  X,  MCT,  TpL,  and  Tpj 
are  prime  candidates  for  BIT. 

o  The  sum  of  columns  2  and  3  (Table  3)  is  a  measure  of  the 

number  of  sensors  required  to  isolate  a  given  LRU.  The  larger 
the  number  of  inputs  and  outputs,  the  higher  the  cost  in 
sensors.  LRU's  with  a  minimum  number  of  inputs  and  outputs 
should  be  considered  for  BIT  isolation. 

o  Sensor  failure  rates,  column  3S  of  Table  4,  must  be  balanced 
against  the  sensor  fault  indication  rate,  column  2S,  to 
minimize  false  alarms.  In  order  words,  a  sensor  failure  rate 
eqi valent  to  its  false  alarm  rate  will  result  in  numerous 
false  alarms  by  the  BIT  system  and  cause  mistrust  by  operational 
personnel . 

o  Feasibility,  cost,  and  computational  requirements  must  be 

considered  to  measure  the  benefits  of  adding  a  particular  sensor. 
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o  Column  7S  (Table  4)  emphasizes  the  basic  past  use  of  BIT 
as  an  alarm  device. 

o  Column  8S  (Table  4)  is  used  to  evaluate  the  cost/benefit  of 
BIT. 

Table  3.  LRU  BIT  Evaluation  Data 
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7 

7 
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Columns  1,  2  and  3  are  completed  from  the  system  block  diagram. 


Column  5  is  a  measure  of  the  dependence  (D)  of  multiple  outputs 
which  have  common  components  and  is  a  function  of  the  number  of  components 
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and/or  failure  rates.  One-hundred  percent  dependency  between  outputs  means 
that  if  one  output  fails  the  other  also  fails  and  can  be  computed  as: 


D  = 


JC+XD 


(6) 


where 

D  is  the  dependency  of  output  i  on  output  j , 

Xj.  is  failure  rate  of  components  common  to  outputs  i  and  j,  and 
XQ  is  failure  rate  of  components  peculiar  to  the  i  output. 

Columns  4,  6,  7,  8,  9  and  10  are  completed  from  FMEA  and 
maintenance  analysis  data. 

Table  4.  Sensor  BIT  Evaluation  Data 


nsor 


2S 

(Fault 

Rate 

X10*6) 

3S 

(Failure 

Rate 

X10'6) 

1  43 

1 

(Feasi¬ 

bility) 

rss 

(Cost) 

- 75 

(Requi red 
for  Go/ 
No-Go) 

8S 

(Mean 

Time- 

To- 

Repai r 

F1 

AS1 

No 

M 

uTSl 

F2 

AS2 

No 

MCTS2 

F3 

AS3 

No 

MCTS3 

F4 

AS4 

No 

MCTS4 

F5 

AS5 

No 

MCTS5 

F6 

AS6 

No 

MCTS6 

F7 

AS7 

No 

MCTS7 

F8 

AS8 

No 

MCTS8 

F9 

AS9 

No 

MCTS9 

F10 

AS10 

Yes 

mctsio 

Column  IS  tabulates  the  sensors  from  the  system  block  diagram. 

Column  2S  is  computed  by  summing  the  failure  rates  of  LRU's 
causing  the  sensor  to  indicate  a  fault.  For  instance: 

F4  =  +  ^2_3  +  ^4  (7) 

Column  3S  and  8S  are  obtained  from  FMEA  and  maintenance  data. 


Column  7S  is  from  system  analysis. 

Column  4S,  5S,  and  6S  are  based  on  analysis  of  the  particular 
sensor  hardware  requirements  and  can  vary  from  a  weighted  scale  of  1  to 
10  to  detailed  dollar  and/or  man-hour  requirements. 

Sensors  are  eliminated  from  Figure  8  based  on  the  above  criteria, 
and  the  various  sensor  sets  are  evaluated  using  failure  data  as  follows: 

BIT  Detectabili ty  Level  (BDL) 

BDL  =  A~Xu  (8) 

A 


BIT  Isolation  Level  (BIL) 


BIL 


A— A  -A,it 
u  NI 

A- A 


(9) 


where 

A  is  the  failure  rate  without  BIT, 

Ay  is  the  failure  rate  of  components  undetected  by  BIT,  and 
A^j  is  the  failure  rate  of  components  not  isolated  by  BIT. 
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1 


1 


Comparison  of  the  above  computed  levels  with  specifications 
determines  whether  the  various  sensor  sets  meet  the  requirements.  For 
example,  using  sensors  1,  6  and  9  in  Figure  8: 

XA  -A 

BDL  =  <*) 


BIL 


ZAr(A0)  =  (A2+A2+A^+Ag+Ag+A^) 
EAi-(Ag) 


(9) 


8.3.4  Design  Example 

Based  on  the  previous  criteria  and  the  assumptions: 

^l<^2-2’^2-3,/1'3,^4;  sensor  set  1,  6,  7,  8,  9  and  10  would  be 
picked.  Sensors  7  and  8  would  be  eliminated  by  redundancy  considerations 
leaving  sensors  1,  6,  9  and  10. 


The  BIT  Detectability  Level  (BDL)  and  the  BIT  Isolation  Level 
(BIL)  would  be  computed  for  these  sensors  as: 

A-A  XA.-O 

BDL  =  =  -^1—  =  1.0  (10) 


BIL 


A  —  A  A, i . 

u  NI  _ 

A-A 


XAi-0-(A2+A3+A4+A5+Ag+A7+Ag) 

_ 

1 


(ID 


where 

A  is  the  failure  rate  without  BIT  =  sum  of  all  LRU  A's, 

A^  is  the  failure  rate  of  components  undetected  by  BIT;  i.e., 
this  is  zero  since  sensor  No.  10  faults  on  all  failures,  and 
A^j  is  the  failure  rate  of  components  not  isolated  by  BIT; 
i.e.,  this  is  the  same  as  XA.-A-j  since  LRU  No.  1  is  the  only 
functional  area  isolated  by  the  above  sensor  set. 
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It  is  obvious  from  the  above  that  the  BIL  for  this  sensor  set 
is  very  bad  and  another  set  of  sensors  should  be  selected. 


The  above  procedure  is  followed  until  sensor  sets  are  obtained 
satisfying  the  BDL  and  BIL  specifications.  An  optimum  set  of  sensors  can 
then  be  selected  based  on  the  improvement  in  mean  corrective  maintenance 


time  (MCy)  using  the  formula: 

zVr.'zVs.+abtrb 

mct  =  ZX.+X  J 

1  D 


(12) 


where 


failure  rate  of  the  ith  unit, 

mean- time- to- repair  the  i^  unit  without  BIT, 

th 

failure  rate  of  the  j  unit  which  contains  BIT, 

time  saved  in  repair  of  the  jth  unit  by  incorporating  BIT, 

failure  rate  of  BIT  circuitry,  and 

the  time  required  to  repair  failed  BIT  circuitry. 


T<-  =  tlI  =  Time  save<*  by  incorporating  BIT, 

where 

T^ ,  =  mean  time  required  to  perform  fault  location  and  isolation 
with  no  BIT,  and 

TLj  =  mean  time  required  to  perform  fault  location  and  isolation 
aided  by  BIT. 
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where 


BIT 

Detected 


No  BIT 


Location  time 


Isolation  time 


FI, 


T^  =  location  with  no  BIT, 

FI  =  number  of  cards  in  fault-isolation  set, 

N  =  total  number  of  cards,  and 

Tt  *  isolation  time  when  FI  =  1 . 

1  IT 
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Rotational  Molding  of  Plastic  Powders 

313 

ADA-015  181 

Short  Fiber  Plastic  Base  Composites 

314+ 

— 

♦Discontinuous  Glass  Fiber  Reinforced  Plastics 

31 5^ 

— 

♦Dielectric  Embedding  of  Electrical  or 
Electronic  Components 

316" 

— 

♦Joining  of  Advanced  Composites 

317+ 

— 

♦Fabrication  of  Continuous  Fiber  Reinforced 

Plastics 
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Handbook 

No.  706- 

Document  No. 
(Used  by  DDC 
and  NTIS) 

Title 

318x 

— 

^Materials  Engineering  for  Plastic  Product 
Design 

31 9+ 

— 

^Designing  for  NDT  Inspection  Techniques 
for  Structural  Composites 

327 

AD- 830  809 

Fire  Control  Systems  -  General 

329 

AD- 879  465 

Fire  Control  Computing  Systems 

331 

AD- 830  275 

Compensating  Elements 

340 

AD- 830  276 

Carriages  and  Mounts  -  General 

341 

AD-830  277 

Cradles 

342 

AD-830  281 

**Recoil  Systems 

343 

AD- 830  393 

Top  Carriages 

344 

AD- 830  396 

Bottom  Carriages 

345 

ADA-003  347 

Equilibrators 

346 

AD- 830  301 

Elevating  Mechanisms 

347 

AD- 830  291 

Traversing  Mechanisms 

348" 

— 

Design  of  Towed  Artillery  Weapon  Systems 

350 

AD- 881  357 

Wheeled  Amphibians 

355 

AD- 830  268 

The  Automotive  Assembly 

356 

AD-817  023 

Automotive  Suspensions 

357 

AD- 873  103 

Automotive  Bodies  and  Hulls 

358+ 

ADA-035  445 

Analysis  and  Design  of  Automotive  Brake 
Systems 

360 


AD- 783  697 
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Handbook 

No.  706- 

Document  No. 
(Used  by  DDC 
and  NTIS) 

Title 

361 

ADA-013  769 

Military  Vehicle  Power  Plant  Cooling 

410+ 

ADA- 038  803 

Electromagnetic  Compatibility  (EMC) 

411 (S) 

ADC-008  827 

Vulnerability  of  Conmunication-Electronic 
and  Electro-Optical  Systems  (Except  Guided 
Missiles)  to  Electronic  Warfare,  Part  One, 
Introduction  and  General  Approach  to 
Electronic  Warfare  Vulnerability  (U) 

412(C) 

ADC- 008  828 

Part  Two,  Electronic  Warfare  Vulnerability 
of  Tactical  Comnuni cations  (U) 

413(S) 

ADC-008  829 

Part  Three,  Electronic  Warfare  Vulnerability 
of  Ground  Based  and  Airborne  Surveillance 
and  Target  Acquisition  Radars  (U) 

414(S) 

ADC-008  830 

Part  Four,  Electronic  Warfare  Vulnerability 
of  Avionics  (U) 

41 5  ( S ) 

ADC-008  831 

Part  Five,  Optical/Electronic  Warfare 
Vulnerability  of  Electro-Optic  Systems  (U) 

416(S) 

ADC- 008  832 

Part  Six,  Electronic  Warfare  Vulnerability 
of  Satellite  Communications  (U) 

41  7(  S)+ 

-- 

Vulnerability  of  Guided  Missile  Systems  to 
Electronic  Warfare  (U) 

445 

AD- 903  789 

Sabot  Technology  Engineering 

470+ 

ADA-029  902 

Metric  Conversion  Guide 

475" 

— 

♦Quality  Engineering 

480" 

— 

♦Safety  Engineering  Design  Guide  for  Army 

Materiel 

♦UNDER  PREPARATION  -  NOT  AVAILABLE  ♦♦♦LIMITED  DOCUMENTS  ARE  NOT  FOR  SALE 
♦♦REVISION  UNDER  PREPARATION  BY  NTIS 

+DARCOM-P  706- 
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These  Handbooks  are  available  to  Department  of  the  Army  activities  by 
submitting  an  official  requisition  form  (DA  Form  17,  17  Jan  70)  directly 
to  the  Commander,  Letterkenny  Army  Depot,  ATTN:  SDSLE-AJD,  Chambersburg , 

PA  17201.  "Need  to  Know"  justification  must  accompany  request  for  class¬ 
ified  Handbooks.  Requestors  -  DOD,  Navy,  Air  Force,  Marine  Corps,  non¬ 
military  Government  agencies,  contractors,  private  industry,  individuals, 
universities,  and  others  -  who  are  registered  with  the  Defense  Documen¬ 
tation  Center  (DDC)  and  have  a  National  Technical  Information  Service 
(NTIS)  deposit  account  may  obtain  these  Handbooks  from  the  DDC.  To 
obtain  classified  documents  from  the  DDC,  "Need  to  Know"  must  be  established 
by  the  submission  of  DD  Form  1540,  1  Jul  71.  Requestors,  not  part  of  the 
Department  of  the  Army  nor  registered  with  the  DDC,  may  purchase  unclassified 
Handbooks  from  the  National  Technical  Information  Service,  Department  of 
Commerce,  Springfield,  VA  22161.  All  Handbooks  carry  the  prefix  AMCP  706- 
unless  otherwise  indicated. 
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